Error on setting custom AD attributes using ActiveDirectorMembershipProvider

[rurouni42]

All,

We currently have an ASP.NET 2.0 application that sets custom
attributes on Active Directory User accounts via the
ActiveDirectoryMembershipProvider. Specifically, we are using the
ChangePasswordQuestionAndAnswer method to change the password question
and answer for the user. Currently, this works in our Dev, QA and
Staging environments. Unfortunately, this does not work in our
Production environment and we get the following error:

Event code: 3008
Event message: A configuration error has occurred.
Exception information:
Exception type: ConfigurationErrorsException
Exception message: Object reference not set to an instance of an
object. (D:\Inetpub\webapp\web.config line 146)
System.Web.Security.Membership.Initialize()
at System.Web.Security.Membership.get_Provider()
at
Framework.Security.SecurityProvider.ChangeSecretQuestionAndAnswer(St
ring username, String password, String newQuestion, String newAnswer)
at ChangeSecretQA.SecretQAControl1_SubmitClick(Object sender,
EventArgs e) in d:\inetpub\webapp\ ChangeSecretQA.aspx.cs:line
52

What's puzzling is that the config file from the staging and the
production environments are virtually the same. In fact, the staging
and the production servers reside within the domain and the web
application is running under the same service account. We have
confirmed that the LDAP directory is reachable from the server
(performed a telnet test). The offending line (show belown) is exactly
the same as it is in Staging so we are little stumped on why we are
getting this error.

<connectionStrings>
<add name="DmzAdService"
connectionString="LDAP://domain.dmz/DC=domain,DC=dmz"/>
</connectionStrings>
<membership defaultProvider="AtsDmzActiveDirectoryMembershipProvider">
<providers>
<add name="AtsDmzActiveDirectoryMembershipProvider"
connectionStringName=" DmzAdService " enableSearchMethods="true"
connectionUsername="####" connectionPassword="####"
enablePasswordReset="true" requiresQuestionAndAnswer="true"
attributeMapPasswordQuestion="SecretQuestion"
attributeMapPasswordAnswer="SecretQuestionAnswer"
attributeMapFailedPasswordAnswerCount="FailedPasswordAnswerCount"
attributeMapFailedPasswordAnswerTime="FailedPasswordAnswerTime"
attributeMapFailedPasswordAnswerLockoutTime="FailedPasswordAnswerLockoutTime"
requiresUniqueEmail="false"
type="System.Web.Security.ActiveDirectoryMembershipProvider,
System.Web, Version=2.0.50727.42, Culture=neutral,
PublicKeyToken=b03f5f7f11d50a3a"/>
</providers>
</membership>

Any help or ideas you can give me will be greatly appreciated.