Can you be more specific on "AP1100 doesn't seem to provide the correct rejection information to the client supplicant"? What information are you looking for?
AP1100 is an authenticator in 802.1x. It is no different than a message relay agent. It does not provide any reject information at all. All reject information has to come from radius server (or authentication server in 802.1x terminlogy).
The only revelant command is "dot11 holdoff-time"
http://www.cisco.com/univercd/cc/td/doc/product/wireless/airo1100/accsspts/i12215ja/i12215cr/cr15main.htm#wp2442787
The AP just drop any EAP request from the client supplicant for a time defined by you if the client fails authentication 3 times.
Please run the following debugs:
1. debug radius authentication
2. debug dot11 aaa authenticator process
3. debug dot11 aaa authenticator state
4. debug dot11 aaa authenticator rxdata
5. debug dot11 aaa authenticator txdata
From debug radius authenticator, debug dot11 aaa authenticator rxdata, and debug aaa authenticator txdata, you will find out that the AP just take EAP message attribute (type 79) from radius packet from the authentication server and put it into EAPOL packet. For details about the debugs, please go to the following URL:
http://www.cisco.com/en/US/products/hw/wireless/ps430/products_tech_note09186a008024aa4f.shtml
