The switch has TACACs configured, and when I try to log in, I see an accept in Clearpass log, but the switch doesn't allow the login.

The following logs show up:

Nov 18 21:14:16 EX2300 sshd: PAM_USER_LOCK_USER_AUTHEN_NO_LOGIN: User remote is authenticated successfully but no logical login-id configured.

Nov 18 21:14:16 EX2300 sshd[2743]: error: PAM: User account has expired for user from x.x.x.x

Nov 18 21:14:16 EX2300 sshd: SSHD_LOGIN_FAILED: Login failed for user 'user' from host 'x.x.x.x'

Nov 18 21:14:16 EX2300 sshd: SSHD_LOGIN_FAILED: Login failed for user 'user' from host 'x.x.x.x'

In this case the issue is related to the user assigned and or configured in the switch.

So, you can have a local user created to match the TACACS+ server or you can create a remote user that will be assigned to TACACS+ authenticated users. Please find below information:

For RADIUS or TACACS+ local authentication to the Switch, it is necessary to create a remote user account or a different login class. To use different login classes for different RADIUS-authenticated users, create multiple user templates in the Junos OS configuration by using the following CLI commands in the Additional CLI Commands section:

set system login user RO class read-only

set system login user OP class operator

set system login user SU class super-user

set system login user remote full-name "default remote access user template"

set system login user remote class read-only

Link: Switch Configuration Options | Mist | Juniper Networks

Find the following KB with an example: [Junos/Junos EVO] Radius authentication is failing with error: "User remote is authenticated successfully but no logical login-id configured" 

Also, from TACACS+ Authentication | Junos OS | Juniper Networks , you can find the following explanation:

The network device can map TACACS+-authenticated users to a locally defined user account or user template account, which determines authorization. By default, Junos OS assigns TACACS+-authenticated users to the user template account remote, if configured, when:

• The authenticated user does not have a user account configured on the local device.
• The TACACS+ server either does not assign the user to a local user template, or the template that the server assigns is not configured on the local device.

The TACACS+ server can assign an authenticated user to a different user template to grant different administrative permissions to that user. The user retains the same login name in the CLI but inherits the login class, access privileges, and effective user ID from the assigned template. If the TACACS+-authenticated user does not map to any locally defined user account or user template, and the remote template is not configured, then authentication fails.

Note: The remote username is a special case in Junos OS and must always be lowercase. It acts as a template for users who are authenticated by a remote server but do not have a locally configured user account on the device. Junos OS applies the permissions of the remote template to those authenticated users without a locally defined account. All users mapped to the remote template are in the same login class.

TACACS+ Authentication | Junos OS | Juniper Networks

[Junos/Junos EVO] Radius authentication is failing with error: "User remote is authenticated successfully but no logical login-id configured"

Switch Configuration Options | Mist | Juniper Networks ---> Look for section "All Switches" -> "AUTHENTICATION SERVERS"