Work for ticket PUP-4030 uncovered that puppet's http connection code does not support authenticating proxies (that require a username and password). Note there are http_proxy_user and http_proxy_password settings, but they are only used with the PMT and some providers.
Puppet connection handling should be refactored to use Puppet::Util::HttpProxy class.
Puppet agents could not connect via an authenticating HTTP proxy when making REST requests to puppet infrastructure, such as when requesting a catalog. Now puppet agents will observe the http_proxy_user and http_proxy_password settings or HTTP_PROXY_USER/PASSWORD environment variables when making those requests.