Currently, providing a bad username or password in the configuration and a user submitting invalid credentials both redirect to auth/failure with invalid_credentials as the failure message. There is no way to distinguish between the two cases.

Other LDAP connection errors cause the failure message ldap_error, which makes more sense if there is a problem with the configuration.