1. In a wireless network having a set of access points (APs) each having a predetermined service area, a station (STA) that receives a communication service by associating with APs in the set, an authentication server (AS) that authenticates the STA, and a controller that maintains a data structure identifying prospective APs to which the STA may roam, a method, comprising: associating the STA to the first AP by obtaining a security key from the AS; after the first AP reports to the controller that the STA has associated to the first AP using the security key obtained from the AS, forwarding the security key to the controller; while the STA is associated with the first AP, forwarding the security key from the controller to at least a second AP in the set as identified by the data structure; and re-associating the STA at the second AP using the security key and without requiring the STA to authenticate back to the AS; and after re-associating, updating the data structure by notifying the controller that the first AP is a neighbor of the second AP.