It is good practice to just supply a simple Username or Password is invalid message. If the user is performing a reset, ask for their email address and send an email to that account stating it is not a valid email address or send the reset link if it is. The less information you can expose directly on the site the better. It is also a good idea to have the login name and name displayed and used on the site different.
Risks of acknowledging a username is correct or publicly displaying them:
It makes it easy for someone to use a a bot or automated tool to scan your site for user names or test a list of known usernames to build a list of accounts which can then be brute-forced or if the user has a list of stolen usernames and passwords to attempt known passwords that may work if someone uses the same password on multiple sites. With no way to confirm that the account is real, they will not waste their time trying to compromise an account that is questionable if it actually exists. If you confirm an account exists you have given a verified target.