you're hitting a dot1x mac-move issue, the switch is detecting that the mac address has appeared on a previously authorized port, and is denying the auth for the second appearance.  Try adding the following configuration to all of the dot1x enabled p...