Actually on your WDS device you can create two groups, one for Infrastructure authentication and one for client authentication. Configure a local radius server and then configure it in your authentication server list. Then in the WDS configuration ...

I believe this is normal for 12.3(4)JA. I think they mention it in the release notes but have noticed that as well.