We're currently working on January's monthly release of DotNetNuke (05.02.02 - roadmap can be seen at http://support.dotnetnuke.com/Project/Project.aspx?Tab=Roadmap&PROJID=2), and one of the issues I was looking at was a bug in the DotNetNuke Captcha control. This control generates a challenge-response image that can be used to try and validate that an actions is being done by a human and not an automated process (see http://en.wikipedia.org/wiki/CAPTCHA for more background on Captchas).
Usually when fixing a bug in a distinct area of code, I scan our issue log (http://support.dotnetnuke.com) to see if there are any other issues in that area of code that can be resolved. We'll be fixing a few other minor items such as missing ALT text on the image (necessary for XHTML compliance), but I did notice an issue that was raised a few times where a community member reported that the Captcha wasn't working on login. I've tested and it does in fact work on login, and in fact what's happening is a misconfiguration by site admins. There were a few other forum posts and issues about this, so I thought it would be worth blogging about it to help anyone confused.
Historically when the Captcha control was added DotNetNuke only supported Forms Authentication as a login model (and also had windows authentication as an optional free module), so the setting in Admin->User Accounts->User settings enabled or disabled Captcha for login. However, we overhauled the authentication area meaning that additional authentication providers can be easily added (there are core provided openid, liveid and cardspace providers) or created . As many of these require authenticating away from the website, and implement their own Captcha's, it makes no sense to enable duplicate Captchas at the login control level as before.
Instead now, Captchas are enabled at the authentication provider level for each portal. To enable Captcha for login, login as host (or portal admin) and go to Admin->Extensions, select the provider and then check the "Use captcha?" checkbox.
The "original" setting in Admin->user accounts->user settings, is still needed and valid, as it controls whether or not a user needs to provide a Captcha when associating an external provider (such as liveid, openid, cardspace) with their site account. We've updated the title and helptext to hopefully make this clearer.
