diff --git a/apps/emqx_ldap/src/emqx_ldap_authn_bind.erl b/apps/emqx_ldap/src/emqx_ldap_authn_bind.erl
index 37216ef3e..fce78312c 100644
--- a/apps/emqx_ldap/src/emqx_ldap_authn_bind.erl
+++ b/apps/emqx_ldap/src/emqx_ldap_authn_bind.erl
@@ -102,8 +102,14 @@ authenticate(
                     {bind, Entry#eldap_entry.object_name, Credential}
                 )
             of
-                ok ->
+                {ok, #{result := ok}} ->
                     {ok, #{is_superuser => false}};
+                {ok, #{result := 'invalidCredentials'}} ->
+                    ?TRACE_AUTHN_PROVIDER(error, "ldap_bind_failed", #{
+                        resource => ResourceId,
+                        reason => 'invalidCredentials'
+                    }),
+                    {error, bad_username_or_password};
                 {error, Reason} ->
                     ?TRACE_AUTHN_PROVIDER(error, "ldap_bind_failed", #{
                         resource => ResourceId,