diff --git a/connector/ldap/ldap.go b/connector/ldap/ldap.go
index 80f84f2aae4fc5a9ab7b7cc25e7f69a9f85ff191..841ff11062fc08705287af37eaca1acaa06dea42 100644
--- a/connector/ldap/ldap.go
+++ b/connector/ldap/ldap.go
@@ -310,7 +310,9 @@ func (c *ldapConnector) Login(username, password string) (ident connector.Identi
 
 		switch n := len(resp.Entries); n {
 		case 0:
-			return fmt.Errorf("ldap: no results returned for filter: %q", filter)
+			log.Printf("ldap: no results returned for filter: %q", filter)
+			incorrectPass = true
+			return nil
 		case 1:
 		default:
 			return fmt.Errorf("ldap: filter returned multiple (%d) results: %q", n, filter)
@@ -335,6 +337,9 @@ func (c *ldapConnector) Login(username, password string) (ident connector.Identi
 	if err != nil {
 		return connector.Identity{}, false, err
 	}
+	if incorrectPass {
+		return connector.Identity{}, false, nil
+	}
 
 	// Encode entry for follow up requests such as the groups query and
 	// refresh attempts.
@@ -364,7 +369,7 @@ func (c *ldapConnector) Login(username, password string) (ident connector.Identi
 		return connector.Identity{}, false, err
 	}
 
-	return ident, !incorrectPass, nil
+	return ident, true, nil
 }
 
 func (c *ldapConnector) Groups(ident connector.Identity) ([]string, error) {
diff --git a/server/server.go b/server/server.go
index 603a23cb701c06ccac820e22e4cc8814f511f48c..3f34701313fc40fdc0fd79ccf06d1d582bb5c36b 100644
--- a/server/server.go
+++ b/server/server.go
@@ -218,8 +218,9 @@ func (db passwordDB) Login(email, password string) (connector.Identity, bool, er
 	if err != nil {
 		if err != storage.ErrNotFound {
 			log.Printf("get password: %v", err)
+			return connector.Identity{}, false, err
 		}
-		return connector.Identity{}, false, err
+		return connector.Identity{}, false, nil
 	}
 	if err := bcrypt.CompareHashAndPassword(p.Hash, []byte(password)); err != nil {
 		return connector.Identity{}, false, nil
diff --git a/server/server_test.go b/server/server_test.go
index 009a8dc2feef5b9c7e92ebd1f95fe68c913da31b..d3ba1e3e713f19a7a82d221538ada69bb1b6df70 100644
--- a/server/server_test.go
+++ b/server/server_test.go
@@ -657,10 +657,10 @@ func TestPasswordDB(t *testing.T) {
 			},
 		},
 		{
-			name:     "unknown user",
-			username: "john@example.com",
-			password: pw,
-			wantErr:  true,
+			name:        "unknown user",
+			username:    "john@example.com",
+			password:    pw,
+			wantInvalid: true,
 		},
 		{
 			name:        "invalid password",