diff --git a/cluster/identd/ident/BUILD.bazel b/cluster/identd/ident/BUILD.bazel
index 382900e3..17731c20 100644
--- a/cluster/identd/ident/BUILD.bazel
+++ b/cluster/identd/ident/BUILD.bazel
@@ -4,6 +4,7 @@ go_library(
     name = "go_default_library",
     srcs = [
         "client.go",
+        "errors.go",
         "request.go",
         "response.go",
         "server.go",
diff --git a/cluster/identd/ident/errors.go b/cluster/identd/ident/errors.go
new file mode 100644
index 00000000..0581f3cc
--- /dev/null
+++ b/cluster/identd/ident/errors.go
@@ -0,0 +1,38 @@
+package ident
+
+// IdentError is an ErrorResponse received from a ident server, wrapped as a Go
+// error type.
+// When using errors.Is/errors.As against an IdentError, the Inner field
+// controls the matching behaviour.
+//  - If set, the error will match if the tested error is an IdentError with
+//    same ErrorResponse as the IdentError tested against
+//  - If not set, the error will always match if the tested error is any
+//    IdentError.
+//
+// For example:
+//    errors.Is(err, &IdentError{}
+// will be true if err is any *IdentError, but:
+//    errors.Is(err, &IdentError{NoUser})
+// will be true only if err is an *IdentError with an Inner NoUser.
+type IdentError struct {
+	// Inner is the ErrorResponse contained by this error.
+	Inner ErrorResponse
+}
+
+func (e *IdentError) Error() string {
+	return string(e.Inner)
+}
+
+func (e *IdentError) Is(target error) bool {
+	t, ok := target.(*IdentError)
+	if !ok {
+		return false
+	}
+	if t.Inner == "" {
+		return true
+	}
+	if t.Inner == e.Inner {
+		return true
+	}
+	return false
+}