diff --git a/connector/ldap/ldap.go b/connector/ldap/ldap.go
index c50d8309c40e5325e5bb0125572c1754bc172fac..f0aa7eff76716618555dcbb2f6a06f0ac09bcf7e 100644
--- a/connector/ldap/ldap.go
+++ b/connector/ldap/ldap.go
@@ -460,6 +460,7 @@ func (c *ldapConnector) userEntry(conn *ldap.Conn, username string) (user ldap.E
 
 func (c *ldapConnector) Login(ctx context.Context, s connector.Scopes, username, password string) (ident connector.Identity, validPass bool, err error) {
 	// make this check to avoid unauthenticated bind to the LDAP server.
+
 	if password == "" {
 		return connector.Identity{}, false, nil
 	}
@@ -471,6 +472,9 @@ func (c *ldapConnector) Login(ctx context.Context, s connector.Scopes, username,
 		user          ldap.Entry
 	)
 
+	username = ldap.EscapeFilter(username)
+	password = ldap.EscapeFilter(password)
+
 	err = c.do(ctx, func(conn *ldap.Conn) error {
 		entry, found, err := c.userEntry(conn, username)
 		if err != nil {
diff --git a/connector/ldap/ldap_test.go b/connector/ldap/ldap_test.go
index 24254dcc9c0fafe992e6cd6dcb404187a4857323..f00f1ead99a0c6883cf7a3ab8f2a5e9811d6c013 100644
--- a/connector/ldap/ldap_test.go
+++ b/connector/ldap/ldap_test.go
@@ -83,6 +83,18 @@ func TestQuery(t *testing.T) {
 			password:  "foo",
 			wantBadPW: true, // Want invalid password, not a query error.
 		},
+		{
+			name:      "invalid wildcard username",
+			username:  "a*", // wildcard query is not allowed
+			password:  "foo",
+			wantBadPW: true, // Want invalid password, not a query error.
+		},
+		{
+			name:      "invalid wildcard password",
+			username:  "john",
+			password:  "*",  // wildcard password is not allowed
+			wantBadPW: true, // Want invalid password, not a query error.
+		},
 	}
 
 	runTests(t, connectLDAP, c, tests)