The new HTTP Client, JDK-8042950, should support tunnelling through authenticating proxies.

The current implementation will throw IOException if status code is not 200. It seems not to handle 407 during tunneling.

See java.net.http.PlainTunnelingConnection.connect() (line 68~75).
    public void connect() throws IOException, InterruptedException {
        delegate.connect();
        HttpRequestImpl req = new HttpRequestImpl(client, "CONNECT", address);
        Exchange connectExchange = new Exchange(req, acc);
        HttpResponse r = connectExchange.responseImpl(delegate);
        if (r.statusCode() != 200) {
            throw new IOException("Tunnel failed");
        }
        connected = true;
    }