I have had the same issue with a remote site even with local RADIUS infrastructure authentication configured.
TAC had me upgrade the Master WDS AP to 12.3.7(JA3), and it worked like a champ afterwards.
sh wlccp wnm stat
WNM IP Address : xxx.xxx.xxx.xxx Status : SECURITY KEYS SETUP