diff --git a/lib/SimpleSAML/Auth/ProcessingChain.php b/lib/SimpleSAML/Auth/ProcessingChain.php
index ab83ceb7abdefb20fd2d43b62ffbaec8fd715d93..fb7dddee4b7842eb46e3d9abc33d0d6281bbad4d 100644
--- a/lib/SimpleSAML/Auth/ProcessingChain.php
+++ b/lib/SimpleSAML/Auth/ProcessingChain.php
@@ -27,20 +27,20 @@ class ProcessingChain
     /**
      * The list of remaining filters which should be applied to the state.
      */
-    const FILTERS_INDEX = '\SimpleSAML\Auth\ProcessingChain.filters';
+    public const FILTERS_INDEX = '\SimpleSAML\Auth\ProcessingChain.filters';
 
 
     /**
      * The stage we use for completed requests.
      */
-    const COMPLETED_STAGE = '\SimpleSAML\Auth\ProcessingChain.completed';
+    public const COMPLETED_STAGE = '\SimpleSAML\Auth\ProcessingChain.completed';
 
 
     /**
      * The request parameter we will use to pass the state identifier when we redirect after
      * having completed processing of the state.
      */
-    const AUTHPARAM = 'AuthProcId';
+    public const AUTHPARAM = 'AuthProcId';
 
 
     /**
diff --git a/lib/SimpleSAML/Auth/State.php b/lib/SimpleSAML/Auth/State.php
index 7293c30e30f49edc68e61356959c13eb696045e5..e06cd88b051f4529ca8872f0b2e759f6a34ff140 100644
--- a/lib/SimpleSAML/Auth/State.php
+++ b/lib/SimpleSAML/Auth/State.php
@@ -45,50 +45,50 @@ class State
     /**
      * The index in the state array which contains the identifier.
      */
-    const ID = '\SimpleSAML\Auth\State.id';
+    public const ID = '\SimpleSAML\Auth\State.id';
 
 
     /**
      * The index in the cloned state array which contains the identifier of the
      * original state.
      */
-    const CLONE_ORIGINAL_ID = '\SimpleSAML\Auth\State.cloneOriginalId';
+    public const CLONE_ORIGINAL_ID = '\SimpleSAML\Auth\State.cloneOriginalId';
 
 
     /**
      * The index in the state array which contains the current stage.
      */
-    const STAGE = '\SimpleSAML\Auth\State.stage';
+    public const STAGE = '\SimpleSAML\Auth\State.stage';
 
 
     /**
      * The index in the state array which contains the restart URL.
      */
-    const RESTART = '\SimpleSAML\Auth\State.restartURL';
+    public const RESTART = '\SimpleSAML\Auth\State.restartURL';
 
 
     /**
      * The index in the state array which contains the exception handler URL.
      */
-    const EXCEPTION_HANDLER_URL = '\SimpleSAML\Auth\State.exceptionURL';
+    public const EXCEPTION_HANDLER_URL = '\SimpleSAML\Auth\State.exceptionURL';
 
 
     /**
      * The index in the state array which contains the exception handler function.
      */
-    const EXCEPTION_HANDLER_FUNC = '\SimpleSAML\Auth\State.exceptionFunc';
+    public const EXCEPTION_HANDLER_FUNC = '\SimpleSAML\Auth\State.exceptionFunc';
 
 
     /**
      * The index in the state array which contains the exception data.
      */
-    const EXCEPTION_DATA = '\SimpleSAML\Auth\State.exceptionData';
+    public const EXCEPTION_DATA = '\SimpleSAML\Auth\State.exceptionData';
 
 
     /**
      * The stage of a state with an exception.
      */
-    const EXCEPTION_STAGE = '\SimpleSAML\Auth\State.exceptionStage';
+    public const EXCEPTION_STAGE = '\SimpleSAML\Auth\State.exceptionStage';
 
 
     /**
@@ -96,7 +96,7 @@ class State
      * Note that this does not contain a "." since it's used in the
      * _REQUEST superglobal that does not allow dots.
      */
-    const EXCEPTION_PARAM = '\SimpleSAML\Auth\State_exceptionId';
+    public const EXCEPTION_PARAM = '\SimpleSAML\Auth\State_exceptionId';
 
 
     /**
diff --git a/lib/SimpleSAML/Error/CannotSetCookie.php b/lib/SimpleSAML/Error/CannotSetCookie.php
index d3b0f9d537a49b6b0c49ae48546ea80fd568ae2c..3c4faa810bc19b9a3e91b986e378e5d09dd562b3 100644
--- a/lib/SimpleSAML/Error/CannotSetCookie.php
+++ b/lib/SimpleSAML/Error/CannotSetCookie.php
@@ -18,7 +18,7 @@ class CannotSetCookie extends Exception
      *
      * @var int
      */
-    const UNKNOWN = 0;
+    public const UNKNOWN = 0;
 
     /**
      * The exception was due to the HTTP headers being already sent, and therefore we cannot send additional headers to
@@ -26,12 +26,12 @@ class CannotSetCookie extends Exception
      *
      * @var int
      */
-    const HEADERS_SENT = 1;
+    public const HEADERS_SENT = 1;
 
     /**
      * The exception was due to trying to set a secure cookie over an insecure channel.
      *
      * @var int
      */
-    const SECURE_COOKIE = 2;
+    public const SECURE_COOKIE = 2;
 }
diff --git a/lib/SimpleSAML/Kernel.php b/lib/SimpleSAML/Kernel.php
index db6cd3ededa334a5af6d8a91e17aa80cfee9dc8b..3a9877eb4d38deec2a666d6e2211c9fa8ec6fe7e 100644
--- a/lib/SimpleSAML/Kernel.php
+++ b/lib/SimpleSAML/Kernel.php
@@ -22,7 +22,7 @@ class Kernel extends BaseKernel
 {
     use MicroKernelTrait;
 
-    const CONFIG_EXTS = '.{php,xml,yaml,yml}';
+    public const CONFIG_EXTS = '.{php,xml,yaml,yml}';
 
     /** @var string */
     private $module;
diff --git a/lib/SimpleSAML/Locale/Localization.php b/lib/SimpleSAML/Locale/Localization.php
index b00b85f546b51d230ec46e80f55f064077f0e820..ef76a1f4fb0143c4cddd0631ca99bda3074b9c39 100644
--- a/lib/SimpleSAML/Locale/Localization.php
+++ b/lib/SimpleSAML/Locale/Localization.php
@@ -30,21 +30,21 @@ class Localization
      *
      * @var string
      */
-    const DEFAULT_DOMAIN = 'messages';
+    public const DEFAULT_DOMAIN = 'messages';
 
     /**
      * Old internationalization backend included in SimpleSAMLphp.
      *
      * @var string
      */
-    const SSP_I18N_BACKEND = 'SimpleSAMLphp';
+    public const SSP_I18N_BACKEND = 'SimpleSAMLphp';
 
     /**
      * An internationalization backend implemented purely in PHP.
      *
      * @var string
      */
-    const GETTEXT_I18N_BACKEND = 'gettext/gettext';
+    public const GETTEXT_I18N_BACKEND = 'gettext/gettext';
 
     /**
      * The default locale directory
diff --git a/lib/SimpleSAML/Logger.php b/lib/SimpleSAML/Logger.php
index be1742dcdf5c2c69416f75046809f85d162c0271..374b62f2d616603b6928d7440a881538861c8a55 100644
--- a/lib/SimpleSAML/Logger.php
+++ b/lib/SimpleSAML/Logger.php
@@ -78,7 +78,7 @@ class Logger
      *
      * @var string
      */
-    const NO_TRACKID = '_NOTRACKIDYET_';
+    public const NO_TRACKID = '_NOTRACKIDYET_';
 
     /**
      * This variable holds the track ID we have retrieved from the session class. It can also be NULL, in which case
@@ -133,28 +133,28 @@ class Logger
     private static $shuttingDown = false;
 
     /** @var int */
-    const EMERG = 0;
+    public const EMERG = 0;
 
     /** @var int */
-    const ALERT = 1;
+    public const ALERT = 1;
 
     /** @var int */
-    const CRIT = 2;
+    public const CRIT = 2;
 
     /** @var int */
-    const ERR = 3;
+    public const ERR = 3;
 
     /** @var int */
-    const WARNING = 4;
+    public const WARNING = 4;
 
     /** @var int */
-    const NOTICE = 5;
+    public const NOTICE = 5;
 
     /** @var int */
-    const INFO = 6;
+    public const INFO = 6;
 
     /** @var int */
-    const DEBUG = 7;
+    public const DEBUG = 7;
 
 
     /**
diff --git a/lib/SimpleSAML/Metadata/MetaDataStorageHandlerSerialize.php b/lib/SimpleSAML/Metadata/MetaDataStorageHandlerSerialize.php
index 4a81c14c217afebffe5f4355c5f94eba9f7e8842..0a4af9c8309048915ded047f874260e78a302e14 100644
--- a/lib/SimpleSAML/Metadata/MetaDataStorageHandlerSerialize.php
+++ b/lib/SimpleSAML/Metadata/MetaDataStorageHandlerSerialize.php
@@ -22,7 +22,7 @@ class MetaDataStorageHandlerSerialize extends MetaDataStorageSource
      *
      * @var string
      */
-    const EXTENSION = '.serialized';
+    public const EXTENSION = '.serialized';
 
 
     /**
diff --git a/lib/SimpleSAML/Session.php b/lib/SimpleSAML/Session.php
index 0bfadf6336fd42cb5a51bc25933e3ff31b5026c1..9ec54c936a0a0efbe228559ef6e9bc7a1094602e 100644
--- a/lib/SimpleSAML/Session.php
+++ b/lib/SimpleSAML/Session.php
@@ -33,7 +33,7 @@ class Session implements \Serializable, Utils\ClearableState
      * This is a timeout value for setData, which indicates that the data
      * should never be deleted, i.e. lasts the whole session lifetime.
      */
-    const DATA_TIMEOUT_SESSION_END = 'sessionEndTimeout';
+    public const DATA_TIMEOUT_SESSION_END = 'sessionEndTimeout';
 
     /**
      * The list of loaded session objects.
diff --git a/lib/SimpleSAML/Utils/Random.php b/lib/SimpleSAML/Utils/Random.php
index 13cb535f5a2f5797cea0df58f84d0e89b96f6e39..b66119ecfb0ff5a8db9aa83e2ce3b33927735b3a 100644
--- a/lib/SimpleSAML/Utils/Random.php
+++ b/lib/SimpleSAML/Utils/Random.php
@@ -14,7 +14,7 @@ class Random
     /**
      * The fixed length of random identifiers.
      */
-    const ID_LENGTH = 43;
+    public const ID_LENGTH = 43;
 
     /**
      * Generate a random identifier, ID_LENGTH bytes long.
diff --git a/lib/SimpleSAML/Utils/System.php b/lib/SimpleSAML/Utils/System.php
index e2c9e8bb46d2542b0d3f78148e258caeed4ccef4..d76bd84565de74399456e6e43de227969f8b84bf 100644
--- a/lib/SimpleSAML/Utils/System.php
+++ b/lib/SimpleSAML/Utils/System.php
@@ -15,14 +15,14 @@ use SimpleSAML\Error;
 
 class System
 {
-    const WINDOWS = 1;
-    const LINUX = 2;
-    const OSX = 3;
-    const HPUX = 4;
-    const UNIX = 5;
-    const BSD = 6;
-    const IRIX = 7;
-    const SUNOS = 8;
+    public const WINDOWS = 1;
+    public const LINUX = 2;
+    public const OSX = 3;
+    public const HPUX = 4;
+    public const UNIX = 5;
+    public const BSD = 6;
+    public const IRIX = 7;
+    public const SUNOS = 8;
 
 
     /**
diff --git a/modules/admin/lib/Controller/Config.php b/modules/admin/lib/Controller/Config.php
index 423adafb05868b749a6642c7cf4e20cd4a91882a..b9ef5145c5e1cd78000ab4c90a583734bffcec0d 100644
--- a/modules/admin/lib/Controller/Config.php
+++ b/modules/admin/lib/Controller/Config.php
@@ -22,9 +22,9 @@ use Symfony\Component\HttpFoundation\Request;
  */
 class Config
 {
-    const LATEST_VERSION_STATE_KEY = 'core:latest_simplesamlphp_version';
+    public const LATEST_VERSION_STATE_KEY = 'core:latest_simplesamlphp_version';
 
-    const RELEASES_API = 'https://api.github.com/repos/simplesamlphp/simplesamlphp/releases/latest';
+    public const RELEASES_API = 'https://api.github.com/repos/simplesamlphp/simplesamlphp/releases/latest';
 
     /** @var \SimpleSAML\Configuration */
     protected $config;
diff --git a/modules/core/lib/Auth/UserPassBase.php b/modules/core/lib/Auth/UserPassBase.php
index 14890d8de6a49e110f18f220a5c1bbfc3a5129c5..ccba12bcd822188a0da445a75468588b1d968c3b 100644
--- a/modules/core/lib/Auth/UserPassBase.php
+++ b/modules/core/lib/Auth/UserPassBase.php
@@ -27,12 +27,12 @@ abstract class UserPassBase extends \SimpleSAML\Auth\Source
     /**
      * The string used to identify our states.
      */
-    const STAGEID = '\SimpleSAML\Module\core\Auth\UserPassBase.state';
+    public const STAGEID = '\SimpleSAML\Module\core\Auth\UserPassBase.state';
 
     /**
      * The key of the AuthId field in the state.
      */
-    const AUTHID = '\SimpleSAML\Module\core\Auth\UserPassBase.AuthId';
+    public const AUTHID = '\SimpleSAML\Module\core\Auth\UserPassBase.AuthId';
 
     /**
      * Username we should force.
diff --git a/modules/core/lib/Auth/UserPassOrgBase.php b/modules/core/lib/Auth/UserPassOrgBase.php
index b854a240ddf4d5ba679b0caf97e624e2efd13e8d..3ef8bbc2351f241536d75465208de47360ab4a57 100644
--- a/modules/core/lib/Auth/UserPassOrgBase.php
+++ b/modules/core/lib/Auth/UserPassOrgBase.php
@@ -27,20 +27,17 @@ abstract class UserPassOrgBase extends \SimpleSAML\Auth\Source
     /**
      * The string used to identify our states.
      */
-    const STAGEID = '\SimpleSAML\Module\core\Auth\UserPassOrgBase.state';
-
+    public const STAGEID = '\SimpleSAML\Module\core\Auth\UserPassOrgBase.state';
 
     /**
      * The key of the AuthId field in the state.
      */
-    const AUTHID = '\SimpleSAML\Module\core\Auth\UserPassOrgBase.AuthId';
-
+    public const AUTHID = '\SimpleSAML\Module\core\Auth\UserPassOrgBase.AuthId';
 
     /**
      * The key of the OrgId field in the state, identifies which org was selected.
      */
-    const ORGID = '\SimpleSAML\Module\core\Auth\UserPassOrgBase.SelectedOrg';
-
+    public const ORGID = '\SimpleSAML\Module\core\Auth\UserPassOrgBase.SelectedOrg';
 
     /**
      * What way do we handle the organization as part of the username.
diff --git a/modules/exampleauth/lib/Auth/Source/External.php b/modules/exampleauth/lib/Auth/Source/External.php
index a904683950b0d164b75d38558ad7c62d047e6184..235c159adb0771ef7ec730dbc82951ead7f748ed 100644
--- a/modules/exampleauth/lib/Auth/Source/External.php
+++ b/modules/exampleauth/lib/Auth/Source/External.php
@@ -35,7 +35,7 @@ class External extends \SimpleSAML\Auth\Source
     /**
      * The key of the AuthId field in the state.
      */
-    const AUTHID = 'SimpleSAML\Module\exampleauth\Auth\Source\External.AuthId';
+    public const AUTHID = 'SimpleSAML\Module\exampleauth\Auth\Source\External.AuthId';
 
 
     /**
diff --git a/modules/multiauth/lib/Auth/Source/MultiAuth.php b/modules/multiauth/lib/Auth/Source/MultiAuth.php
index 009b9fb8c399ffa6037413ae6e3e882a059792f8..b4e00ad4895bce69f89e6141bbc3e5cc87767507 100644
--- a/modules/multiauth/lib/Auth/Source/MultiAuth.php
+++ b/modules/multiauth/lib/Auth/Source/MultiAuth.php
@@ -24,22 +24,22 @@ class MultiAuth extends \SimpleSAML\Auth\Source
     /**
      * The key of the AuthId field in the state.
      */
-    const AUTHID = '\SimpleSAML\Module\multiauth\Auth\Source\MultiAuth.AuthId';
+    public const AUTHID = '\SimpleSAML\Module\multiauth\Auth\Source\MultiAuth.AuthId';
 
     /**
      * The string used to identify our states.
      */
-    const STAGEID = '\SimpleSAML\Module\multiauth\Auth\Source\MultiAuth.StageId';
+    public const STAGEID = '\SimpleSAML\Module\multiauth\Auth\Source\MultiAuth.StageId';
 
     /**
      * The key where the sources is saved in the state.
      */
-    const SOURCESID = '\SimpleSAML\Module\multiauth\Auth\Source\MultiAuth.SourceId';
+    public const SOURCESID = '\SimpleSAML\Module\multiauth\Auth\Source\MultiAuth.SourceId';
 
     /**
      * The key where the selected source is saved in the session.
      */
-    const SESSION_SOURCE = 'multiauth:selectedSource';
+    public const SESSION_SOURCE = 'multiauth:selectedSource';
 
     /**
      * Array of sources we let the user chooses among.
diff --git a/modules/saml/lib/IdP/SQLNameID.php b/modules/saml/lib/IdP/SQLNameID.php
index 1d810040b910a8e4ed7d96ea2cec4fb357dd3bd5..3d2ed767b568bbeb3c136580962288eea8d4d8eb 100644
--- a/modules/saml/lib/IdP/SQLNameID.php
+++ b/modules/saml/lib/IdP/SQLNameID.php
@@ -19,9 +19,9 @@ use Webmozart\Assert\Assert;
  */
 class SQLNameID
 {
-    const TABLE_VERSION = 1;
-    const DEFAULT_TABLE_PREFIX = '';
-    const TABLE_SUFFIX = '_saml_PersistentNameID';
+    public const TABLE_VERSION = 1;
+    public const DEFAULT_TABLE_PREFIX = '';
+    public const TABLE_SUFFIX = '_saml_PersistentNameID';
 
 
     /**
diff --git a/tests/SigningTestCase.php b/tests/SigningTestCase.php
index e6b279f5cd862d15874f541193620b534facb7fa..44f929e5ea6e9fb09cefe0efb85795701fcce8b1 100644
--- a/tests/SigningTestCase.php
+++ b/tests/SigningTestCase.php
@@ -166,12 +166,12 @@ NOWDOC;
     /** @var \SimpleSAML\Configuration */
     protected $config;
 
-    const ROOTDIRNAME = 'testdir';
-    const DEFAULTCERTDIR = 'certdir';
-    const CA_PRIVATE_KEY = 'ca.key.pem';
-    const CA_CERTIFICATE = 'ca.cert.pem';
-    const GOOD_PRIVATE_KEY = 'good.key.pem';
-    const GOOD_CERTIFICATE = 'good.cert.pem';
+    private const ROOTDIRNAME = 'testdir';
+    private const DEFAULTCERTDIR = 'certdir';
+    private const CA_PRIVATE_KEY = 'ca.key.pem';
+    private const CA_CERTIFICATE = 'ca.cert.pem';
+    private const GOOD_PRIVATE_KEY = 'good.key.pem';
+    private const GOOD_CERTIFICATE = 'good.cert.pem';
 
 
     /**
diff --git a/tests/lib/SimpleSAML/Utils/CryptoTest.php b/tests/lib/SimpleSAML/Utils/CryptoTest.php
index 122728ce77bb466b822146f7593b5595d9b5c356..3cb9cbc3816dc0bc6dc478c8568704ed314194b6 100644
--- a/tests/lib/SimpleSAML/Utils/CryptoTest.php
+++ b/tests/lib/SimpleSAML/Utils/CryptoTest.php
@@ -14,9 +14,9 @@ use SimpleSAML\Utils\Crypto;
  */
 class CryptoTest extends TestCase
 {
-    const ROOTDIRNAME = 'testdir';
+    private const ROOTDIRNAME = 'testdir';
 
-    const DEFAULTCERTDIR = 'certdir';
+    private const DEFAULTCERTDIR = 'certdir';
 
     /** @var \org\bovigo\vfs\vfsStreamDirectory */
     protected $root;
diff --git a/tests/lib/SimpleSAML/Utils/SystemTest.php b/tests/lib/SimpleSAML/Utils/SystemTest.php
index 1db10d8cac5e8faf2a90a0b891ac275529a9dace..9938ceaf480f8ae651798117a799113af57923da 100644
--- a/tests/lib/SimpleSAML/Utils/SystemTest.php
+++ b/tests/lib/SimpleSAML/Utils/SystemTest.php
@@ -16,9 +16,9 @@ use SimpleSAML\Utils\System;
  */
 class SystemTest extends TestCase
 {
-    const ROOTDIRNAME = 'testdir';
+    private const ROOTDIRNAME = 'testdir';
 
-    const DEFAULTTEMPDIR = 'tempdir';
+    private const DEFAULTTEMPDIR = 'tempdir';
 
     /** @var \org\bovigo\vfs\vfsStreamDirectory */
     protected $root;
diff --git a/tests/lib/SimpleSAML/Utils/XMLTest.php b/tests/lib/SimpleSAML/Utils/XMLTest.php
index 7a552424faefd7b0af19124d58380fbdbc3f0b85..f2220edb9337792d28efadb66fef070f8d3aaaf7 100644
--- a/tests/lib/SimpleSAML/Utils/XMLTest.php
+++ b/tests/lib/SimpleSAML/Utils/XMLTest.php
@@ -13,9 +13,7 @@ use SimpleSAML\Utils\XML;
  */
 class XMLTest extends TestCase
 {
-    const FRAMEWORK = 'vendor/simplesamlphp/simplesamlphp-test-framework';
-    // Visibility on constants is supported from PHP 7.1 and up
-    // private const FRAMEWORK = 'vendor/simplesamlphp/simplesamlphp-test-framework';
+    private const FRAMEWORK = 'vendor/simplesamlphp/simplesamlphp-test-framework';
 
     /**
      * @covers \SimpleSAML\Utils\XML::isDOMNodeOfType
diff --git a/tests/lib/SimpleSAML/XML/ParserTest.php b/tests/lib/SimpleSAML/XML/ParserTest.php
index aa709273f1bc8e9737f6468d087b81f260d6a105..b86fdc0600ea7d36510b3de587593616623220d6 100644
--- a/tests/lib/SimpleSAML/XML/ParserTest.php
+++ b/tests/lib/SimpleSAML/XML/ParserTest.php
@@ -17,7 +17,7 @@ use SimpleSAML\XML\Parser;
  */
 class ParserTest extends TestCase
 {
-    const XMLDOC = <<< XML
+    private const XMLDOC = <<< XML
 <?xml version="1.0" encoding="UTF-8"?>
 <Root>
   <Value>Hello, World!</Value>
diff --git a/tests/lib/SimpleSAML/XML/SignerTest.php b/tests/lib/SimpleSAML/XML/SignerTest.php
index b3383701405aa9ddf9f02d57f517188c9a319412..9f972b9edf89541fdf65fd699fded324a5d94aed 100644
--- a/tests/lib/SimpleSAML/XML/SignerTest.php
+++ b/tests/lib/SimpleSAML/XML/SignerTest.php
@@ -48,11 +48,11 @@ d2udRIYG0WcjQTk86+EraXNGtuwUaknQ7WPKlJwLzypuZM8lk3F1FXxXWomHN3SH
 -----END CERTIFICATE-----
 NOWDOC;
 
-    const ROOTDIRNAME = 'testdir';
+    private const ROOTDIRNAME = 'testdir';
 
-    const DEFAULTCERTDIR = 'certdir';
+    private const DEFAULTCERTDIR = 'certdir';
 
-    const OTHER_CERTIFICATE = 'other_certificate.pem';
+    private const OTHER_CERTIFICATE = 'other_certificate.pem';
 
 
     /**