@Override
    protected HttpResponse fetchMetadata(final SamlRegisteredService service,
                                         final String metadataLocation, final CriteriaSet criteriaSet, final File backupFile) {
        val metadata = samlIdPProperties.getMetadata().getMdq();
        val headers = new LinkedHashMap<String, String>();
        headers.put(HttpHeaders.CONTENT_TYPE, metadata.getSupportedContentType());
        headers.put(HttpHeaders.ACCEPT, "*/*");
        val path = backupFile.toPath();
        FunctionUtils.doAndHandle(p -> {
            if (Files.exists(path)) {
                val etag = new String((byte[]) Files.getAttribute(path, "user:ETag"), StandardCharsets.UTF_8).trim();
                headers.put("If-None-Match", etag);
            }
        });
        LOGGER.trace("Fetching metadata via MDQ for [{}]", metadataLocation);
        val exec = HttpExecutionRequest.builder()
            .basicAuthPassword(metadata.getBasicAuthnPassword())
            .basicAuthUsername(metadata.getBasicAuthnUsername())
            .method(HttpMethod.GET)
            .url(metadataLocation)
            .headers(headers)
            .proxyUrl(service.getMetadataProxyLocation())
            .build();
        val response = HttpUtils.execute(exec);
        if (response == null) {
            LOGGER.error("Unable to fetch metadata from [{}]", metadataLocation);
            throw UnauthorizedServiceException.denied("Rejected: %s".formatted(metadataLocation));
        }
        return response;
    }
This is {@link MetadataQueryProtocolMetadataResolver}.

@author Misagh Moayyed
@since 5.2.0
support/cas-server-support-saml-idp-metadata/src/main/java/org/apereo/cas/support/saml/services/idp/metadata/cache/resolver/MetadataQueryProtocolMetadataResolver.java