diff --git a/auth/credentials/tests/test_creds.c b/auth/credentials/tests/test_creds.c
index 2cb2e6d0e34..e79f08982ad 100644
--- a/auth/credentials/tests/test_creds.c
+++ b/auth/credentials/tests/test_creds.c
@@ -227,6 +227,8 @@ static void torture_creds_krb5_state(void **state)
 	TALLOC_CTX *mem_ctx = *state;
 	struct cli_credentials *creds = NULL;
 	struct loadparm_context *lp_ctx = NULL;
+	enum credentials_obtained kerberos_state_obtained;
+	enum credentials_use_kerberos kerberos_state;
 	bool ok;
 
 	lp_ctx = loadparm_init_global(true);
@@ -234,18 +236,27 @@ static void torture_creds_krb5_state(void **state)
 
 	creds = cli_credentials_init(mem_ctx);
 	assert_non_null(creds);
-	assert_int_equal(creds->kerberos_state_obtained, CRED_UNINITIALISED);
-	assert_int_equal(creds->kerberos_state, CRED_USE_KERBEROS_DESIRED);
+	kerberos_state_obtained =
+		cli_credentials_get_kerberos_state_obtained(creds);
+	kerberos_state = cli_credentials_get_kerberos_state(creds);
+	assert_int_equal(kerberos_state_obtained, CRED_UNINITIALISED);
+	assert_int_equal(kerberos_state, CRED_USE_KERBEROS_DESIRED);
 
 	ok = cli_credentials_set_conf(creds, lp_ctx);
 	assert_true(ok);
-	assert_int_equal(creds->kerberos_state_obtained, CRED_SMB_CONF);
-	assert_int_equal(creds->kerberos_state, CRED_USE_KERBEROS_DESIRED);
+	kerberos_state_obtained =
+		cli_credentials_get_kerberos_state_obtained(creds);
+	kerberos_state = cli_credentials_get_kerberos_state(creds);
+	assert_int_equal(kerberos_state_obtained, CRED_SMB_CONF);
+	assert_int_equal(kerberos_state, CRED_USE_KERBEROS_DESIRED);
 
 	ok = cli_credentials_guess(creds, lp_ctx);
 	assert_true(ok);
-	assert_int_equal(creds->kerberos_state_obtained, CRED_SMB_CONF);
-	assert_int_equal(creds->kerberos_state, CRED_USE_KERBEROS_DESIRED);
+	kerberos_state_obtained =
+		cli_credentials_get_kerberos_state_obtained(creds);
+	kerberos_state = cli_credentials_get_kerberos_state(creds);
+	assert_int_equal(kerberos_state_obtained, CRED_SMB_CONF);
+	assert_int_equal(kerberos_state, CRED_USE_KERBEROS_DESIRED);
 	assert_int_equal(creds->ccache_obtained, CRED_GUESS_FILE);
 	assert_non_null(creds->ccache);
 
@@ -253,15 +264,21 @@ static void torture_creds_krb5_state(void **state)
 						CRED_USE_KERBEROS_REQUIRED,
 						CRED_SPECIFIED);
 	assert_true(ok);
-	assert_int_equal(creds->kerberos_state_obtained, CRED_SPECIFIED);
-	assert_int_equal(creds->kerberos_state, CRED_USE_KERBEROS_REQUIRED);
+	kerberos_state_obtained =
+		cli_credentials_get_kerberos_state_obtained(creds);
+	kerberos_state = cli_credentials_get_kerberos_state(creds);
+	assert_int_equal(kerberos_state_obtained, CRED_SPECIFIED);
+	assert_int_equal(kerberos_state, CRED_USE_KERBEROS_REQUIRED);
 
 	ok = cli_credentials_set_kerberos_state(creds,
 						CRED_USE_KERBEROS_DISABLED,
 						CRED_SMB_CONF);
 	assert_false(ok);
-	assert_int_equal(creds->kerberos_state_obtained, CRED_SPECIFIED);
-	assert_int_equal(creds->kerberos_state, CRED_USE_KERBEROS_REQUIRED);
+	kerberos_state_obtained =
+		cli_credentials_get_kerberos_state_obtained(creds);
+	kerberos_state = cli_credentials_get_kerberos_state(creds);
+	assert_int_equal(kerberos_state_obtained, CRED_SPECIFIED);
+	assert_int_equal(kerberos_state, CRED_USE_KERBEROS_REQUIRED);
 
 }