diff --git a/src/Auth/LDAP.hs b/src/Auth/LDAP.hs
index c8e49ab16..471e59dd7 100644
--- a/src/Auth/LDAP.hs
+++ b/src/Auth/LDAP.hs
@@ -219,8 +219,8 @@ campusLogin pool mode = AuthPlugin{..}
             , isUnusualADError adError -> do
                 $logInfoS apName [st|#{campusIdent}: #{toPathPiece adError}|]
                 observeLoginOutcome apName LoginADInvalidCredentials
-                setSessionJson SessionError . InternalError $ toPathPiece adError
                 MsgRenderer mr <- liftHandler getMsgRenderer
+                setSessionJson SessionError . PermissionDenied . mr $ ADInvalidCredentials adError
                 loginErrorMessage (tp LoginR) . mr $ ADInvalidCredentials adError
           Right (Left bindErr) -> do
             case bindErr of