diff --git a/keystone/common/ldap/core.py b/keystone/common/ldap/core.py
index e1a9f0538d..0c6c7e75ae 100644
--- a/keystone/common/ldap/core.py
+++ b/keystone/common/ldap/core.py
@@ -183,9 +183,8 @@ class BaseLdap(object):
 
     def create(self, values):
         if not self.allow_create:
-            msg = _('LDAP backend does not allow %s create') \
-                % self.options_name
-            raise exception.ForbiddenAction(msg)
+            action = _('LDAP %s create') % self.options_name
+            raise exception.ForbiddenAction(action=action)
 
         conn = self.get_connection()
         object_classes = self.structural_classes + [self.object_class]
@@ -290,9 +289,8 @@ class BaseLdap(object):
 
     def update(self, id, values, old_obj=None):
         if not self.allow_update:
-            msg = _('LDAP backend does not allow %s update') \
-                % self.options_name
-            raise exception.ForbiddenAction(msg)
+            action = _('LDAP %s update') % self.options_name
+            raise exception.ForbiddenAction(action=action)
 
         if old_obj is None:
             old_obj = self.get(id)
@@ -318,9 +316,8 @@ class BaseLdap(object):
 
     def delete(self, id):
         if not self.allow_delete:
-            msg = _('LDAP backend does not allow %s delete') \
-                % self.options_name
-            raise exception.ForbiddenAction(msg)
+            action = _('LDAP %s delete') % self.options_name
+            raise exception.ForbiddenAction(action=action)
 
         conn = self.get_connection()
         conn.delete_s(self._id_to_dn(id))