How do I display a page to the user when basic authorization fails or is cancelled?

As I wrote in my first message the apache web server does not perform the authentication in this case but the servlet does. So the web-server could not send his error- page because the browser does not send any information about pressing the cancel-button.

The solution is, that you not only have to send an HttpServletResponse with

res.setStatus(HttpServletResponse.SC_UNAUTHORIZED);

but in addition you have to send content through the response's PrintWriter which is shown by the browser if the user cancels authentication.