Hello everyone. The problem that when responding with 401 status it does not send WWW-Authenticate in responce, thus not triggering my client application authorization chain.
According to the spec:
A server using HTTP authentication will
respond with a 401 Unauthorized response
to a request for a protected resource.
This response must include at least one
WWW-Authenticate header and at least one challenge