The AP that you assign the role of "WDS" will act as an authentication proxy; i.e., the client's authentication traffic is routed through the WDS AP .. as the client roams, the hashed credentials are forwarded to the "next" AP that will handle that client's traffic ... the hashed credentials greatly improve the probability that the client will not lose the connection during the hand-over.
The WLSE is a wireless network management system. It will provide status and control for the entire network from a central location, including rogue management, client tracking, software updates (individual, several, or all... on a schedule or immediately).
The WLSE also provides the usual reporting capabilities.
The WLSM is only required if you need Layer 3 mobility (client that roams between subnets). The WLSM is the only device that has the necessary logical mechanisms to provide that type of service (accomplished using a point-to-multipoint tunnel).
L2 mobility can be done using the WDS (client roams within a single broadcast domain).
I believe the fast-roaming featues require using LEAP or EAP-Fast .... which could use the local database (on an AP) ... but only up to 50 client names/user names. The ACS give you the same authentication functionality (lots more, actually) but for a much larger client base.
Good Luck
Scott
