APM Login page custom Error description, for AD and Radius

APM login using two-factor authentication. I have set up AD and Radius (Digipass Vasco). All login failures show incorrect username or password. How do I customize, to show a token failure versus a AD failure for the login page?

Variable assign shows the following.

session.custom.holder = expr { [mcget {session.logon.last.password}] } session.logon.last.password = expr { [mcget {session.logon.last.token}] }