The issue may due to WDS master is not configured to authenticate clients, just to authenticate masters alone. AP needs to be registered on the WDS to start the authentication process. For this, the AP must also be configured as if it was an Infrastructure AP (on the web interface: wireless services-AP participate in SWAN infrastructure- username and password).
Also, the infrastructure APs should not have the servers specified, they override the decisions made by the WDS, only the WDS master should. If you dont specify servers on infrastructure APs, they send the requests to the WDS master, and it will tell them to authenticate or not.