Handle Kubeflow authentication/authorization errors

Describe the issue See below.

To Reproduce Steps to reproduce the behavior:

1. Provision a secured KFP deployment
2. Create a runtime configuration in Elyra that meets one of the following criteria
   • no user name + password specified
   • invalid user name specified
   • invalid password specified
3. Create a notebook
4. Create a pipeline
5. Add notebook to pipeline
6. Using the “invalid” runtime configuration run pipeline OR export pipeline DSL and run DSL
7. Observe failure

   f"pipeline submitted: {api_endpoint}/#/runs/details/{run.id}",
    AttributeError: 'NoneType' object has no attribute 'id'
   

During a preliminary investigation I’ve noticed that there are several silent errors that are never detected. For example, experiment creation fails without raising an error. It appears that the kfp client (tested with 0.7.0) doesn’t seem to detect/handle/expose authentication/authorization issues caused by missing/invalid credentials.

Expected behavior A clear and concise description of what you expected to happen. Elyra analyzes the KFP response for signs that an API call might have failed even though no exception is raised or error returned.

Deployment information Describe what you’ve deployed and how:

• Elyra version: 2.3/master (likely also in earlier versions)
• Kubeflow 1.3 with security enabled (e.g. via DEX) - didn’t test earlier versions

[ptitzler]

I believe we should treat this as a bug in Elyra because the call in https://github.com/elyra-ai/elyra/blob/master/elyra/pipeline/processor_kfp.py#L86-L88 returns None as session cookie when invalid credentials were specified. Unfortunately https://github.com/elyra-ai/elyra/blob/e82a3ec8b189ac94ade9d87e4482e0b760d5596b/elyra/pipeline/processor_kfp.py#L488 does not return a 403 HTTP status code if invalid credentials were provided. Therefore we might have to interpret the absence of a cookie as a failure condition and raise an authentication error.

[ptitzler]

No guarantee because we are only testing with one Dex configuration. But since things are already failing should a host ever return an auth URL that our pattern match doesn’t catch, we are at least not regressing when we add the additional code(c: