--- a/sys/netproto/802_11/wlan/ieee80211_hostap.c
+++ b/sys/netproto/802_11/wlan/ieee80211_hostap.c
@@ -1950,7 +1950,18 @@
 			reassoc = 0;
 			resp = IEEE80211_FC0_SUBTYPE_ASSOC_RESP;
 		}
-		if (ni == vap->iv_bss) {
+		/*
+		 * NB: node-table existence is NOT authentication: a single
+		 * shared key auth request creates the node before the
+		 * exchange completes.  For authmodes that complete auth at
+		 * the 802.11 layer (shared, auto) require the port to be
+		 * authorized (= exchange completed) before associating.
+		 * 802.1x/WPA defer authentication to after association.
+		 */
+		if (ni == vap->iv_bss ||
+		    ((ni->ni_authmode == IEEE80211_AUTH_SHARED ||
+		      ni->ni_authmode == IEEE80211_AUTH_AUTO) &&
+		     !ieee80211_node_is_authorized(ni))) {
 			IEEE80211_NOTE_MAC(vap, IEEE80211_MSG_ANY, wh->i_addr2,
 			    "deny %s request, sta not authenticated",
 			    reassoc ? "reassoc" : "assoc");