diff --git a/hadoop-common-project/hadoop-common/CHANGES.txt b/hadoop-common-project/hadoop-common/CHANGES.txt
index 7d7982f61a0..e9be2e0816b 100644
--- a/hadoop-common-project/hadoop-common/CHANGES.txt
+++ b/hadoop-common-project/hadoop-common/CHANGES.txt
@@ -746,6 +746,9 @@ Release 2.8.0 - UNRELEASED
     HADOOP-12280. Skip unit tests based on maven profile rather than
     NativeCodeLoader.isNativeCodeLoaded (Masatake Iwasaki via Colin P. McCabe)
 
+    HADOOP-12318. Expose underlying LDAP exceptions in SaslPlainServer. (Mike
+    Yoder via atm)
+
   OPTIMIZATIONS
 
     HADOOP-11785. Reduce the number of listStatus operation in distcp
diff --git a/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/SaslPlainServer.java b/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/SaslPlainServer.java
index 7d1b98062b0..7c74f4ad0b5 100644
--- a/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/SaslPlainServer.java
+++ b/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/SaslPlainServer.java
@@ -105,7 +105,7 @@ public class SaslPlainServer implements SaslServer {
         authz = ac.getAuthorizedID();
       }
     } catch (Exception e) {
-      throw new SaslException("PLAIN auth failed: " + e.getMessage());
+      throw new SaslException("PLAIN auth failed: " + e.getMessage(), e);
     } finally {
       completed = true;
     }