WPA can do central authentication to a RADIUS server. The RADIUS server stores credentials and would need to be internet accessible so each access point can get to it over its internet connection. The problems you'll probably run into are that implementations of RADIUS authentication vary widely among different brands of wireless hardware and a lot of the cheap, consumer grade access points won't even have the capability.