title: How to clear status 401 HttpServletResponse.SC_UNAUTHORIZED?
body: <p>I have created a Filter for my Java/Tomcat application which authenticates the user via kerberos using spnego.  It works marvelous except if the user has IWA (Integrated Windows Authentication) off.  The first thing that the filter does is set SC_UNAUTHORIZED (401) in order to get the browser to negotiate.</p>
  
  <pre><code>httpResponse.setStatus(HttpServletResponse.SC_UNAUTHORIZED, true);
  </code></pre>
  
  <p>Once this happens it will run the same path and fail, over and over, and end up with a blank page.  What I have done is added a session variable to count the number of failures.  After three failures I want to clear the SC_UNAUTHORIZED and let the page continue to load.  All this will mean is that the user will end up on the site but not logged in, which is great.</p>
  
  <p>I have tried this to clear out the flag but it does nothing at all:</p>
  
  <pre><code>System.out.println("check status 1: " + httpResponse.getStatus());
  httpResponse.setStatus(HttpServletResponse.SC_OK);
  System.out.println("check status 2: " + httpResponse.getStatus());
  </code></pre>
  
  <p>Both prints are still 401.  I would have expected the second one to be 200.  How do you change the SC_UNAUTHORIZED once it has been set?  I know I'm just missing something simple.</p>