On Juniper SRX devices, certain configuration commands (e.g., set system login, set system root-authentication) may be denied for non-root users. This issue typically stems from custom CLI authorization restrictions applied to the user's class.

When using the command, the keywords are not identified

# set system login

^

# set system root-authentication

^

> Show configuration | display set | match "class/admin" doesn't provide any configurations

Output of show cli authorization on the affected device shows:

CRAdmin@HDFC_Mumbai_Windsor# run show cli authorization

Current user: 'admin  ' class 'Admin'

Permissions:

  access   -- Can view access configuration

  access-control-- Can modify access configuration

  admin   -- Can view user accounts

  admin-control-- Can modify user accounts

  clear   -- Can clear learned network info

  control  -- Can modify any config

  field   -- Can use field debug commands

  firewall  -- Can view firewall configuration

  firewall-control-- Can modify firewall configuration

  floppy   -- Can read and write the floppy

  interface -- Can view interface configuration

  interface-control-- Can modify interface configuration

  maintenance -- Can become the super-user

  network  -- Can access the network

  rollback  -- Can rollback to previous configurations

  routing  -- Can view routing configuration

  routing-control-- Can modify routing configuration

  secret   -- Can view secret

 idp-profiler-operation-- Can Profiler data

  pgcp-session-mirroring-- Can view pgcp session mirroring configuration

  pgcp-session-mirroring-control-- Can modify pgcp session mirroring configuration

  unified-edge-- Can view unified edge configuration

  unified-edge-control-- Can modify unified edge configuration

Individual command authorization:

  Allow regular expression: none

  Deny regular expression: none

  Allow configuration regular expression: none

  Deny configuration regular expression: (system login)|(system root-authentication). <<<<<<<<<<<<<

On working devices, the same command returns:

Deny configuration regular expression: none. <<<<<<<<<<<<<<<

Root user access is unavailable due to an unknown root password.

The user class admin is configured with restricted permissions via a CLI authorization policy that denies access. This restriction was most likely applied by the root user and is enforced under the current login class settings. 
To resolve the issue, root access is required to modify the user class restrictions. If root password is unknown, a password recovery procedure must be performed from bootloader.