OKC

With opportunistic key caching, the management of WLAN client keys is moved to a WLC or central switch, which manages all of the APs in the network. When a client authenticates at an AP, the downstream WLC, which acts as the authenticator, performs the key management and returns the PMK to the AP for forwarding to the client. If the client moves to another cell, it uses this PMK and the MAC address of the new AP to calculate a PMKID, and it sends this to the new AP in the expectation that OKC is enabled (i.e. "opportunistic"). If the AP is unable to handle the PMKID, it negotiates a regular 802.1X authentication with the client.

An AP is even able to perform OKC if the WLC is temporarily unavailable. In this case it stores the PMK and sends it to the WLC, once available again. The WLC then sends the PMK to all of the AP in the network so that the client can continue to use OKC when moving between cells.

With this setting you enable OKC on the AP which is to be managed by the WLC.