Don't know if it's the issue but (sAMAccountName=%s)) has an extra close paren. Might want to add this to the store (sorry, I like YAML better than Config::General)-

        ldap_server_options:
          timeout: 30
          onerror: warn
[download]

I would also recommend never taking query params for login; insist on POST params. Otherwise some user might discover that she can auto-login with a URL with her credentials in the query string.

            my $user     = $c->req->params->{user}
        and my $password = $c->req->params->{password}
# Becomes...
           my $user = $c->request->body_params->{user}
   and my $password = $c->request->body_params->{password}
[download]