I'm having a problem with getting the captcha image to show up in our test environment.  We have DNN 5.6.2.  And we have two portals running off the same database, same servers, and same CPDNN directory tree; we'll call one site1.example.com and the other site2.example.com.  Both domain names resolve to the same IP.  And both portals have been working in general.  Both have Active Directory authentication turned on (v5.0.2).  I started describing the issue in this thread: http://www.dotnetnuke.com/Resources/Forums/forumid/210/postid/430813/scope/posts.aspx

But for some reason I can't seem to reply to that one anymore.

My issue is trying to enable captcha images on the AD login page.  I found the 'Security_CaptchaLogin' setting in the dbo.PortalSettings table, and that does seem to invoke the control.  My problem is that one of the sites shows a broken captcha image, while the other site works fine.  If I go to the login page for site2 (http://site2.example.com/login.aspx) the image captcha shows the broken image icon.  The same login page for site1 does not have this problem.  Testing a bit further, I tried turning on DNN default auth on both sites, and enabling captcha.  Both sites show the image correctly for DNN auth, but still only site2 shows a broken image captcha for windows/AD login.

If I find the URL for the image captcha and try to navigate to that, I think I get a little closer to understanding the problem.  The URL for the image captcha on site1 is:
http://site1.example.com/DesktopModules/AuthenticationServices/ActiveDirectory/ImageChallenge.captcha.aspx?captcha=blah&alias=site1.example.com

but on site2 its redirected to:
http://site2.example.com/login.aspx?ReturnUrl=%2fDesktopModules%2fAuthenticationServices%2fActiveDirectory%2fImageChallenge.captcha.aspx%3fcaptcha%3dblahblah%26alias%3dtsite2.example.com&captcha=yadda&alias=site2.example.com
(i cut out the long nonsense numbers)


Can someone help me understand why this is happening?  Why would the captcha image try to redirect to the login page?  Why would this only happen on one of the sites and not the other?  What can I do to fix it?

Well, I don't particularly understand it either.  But I'm not really a security guy.  I was asked to put this in place, so I'm trying to figure out how.

But, yes, both sites are on the same DNN install.  On the same server.  The same DB.  Same file directory.  Same web.config.  Same IIS site. Both are using AD logins.  The problem comes up on our test environment.  I was able to get both sites to use the captcha on the AD login page on the dev environment.  Dev has a very similar setup (both sites have same db, file system, web.config, etc). 

I very much appreciate any help or guidance.  Thank you.