Not releasing information about users and only displaying a generic "invalid username or password" is good practice in order to limit account enumeration attacks.

I don't think Keycloak has custom messages for the cases you have mentioned; for LDAP, Keycloak would additionally require checking specific LDAP flags / attributes, as authentication is usually done through a simple "bind" operation with the username and password, and the server will likely just return a failure status, without flagging a specific reason.