There's a Client Exclusion element on the WLC. By default, a client is excluded from associating to the AP by 60 seconds after the client fails to authenticate three times.
Getting Started
Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: