This article explains situation when "authentication denied" is seen while using root user credentials to login via console.

When logging in to RE0 with the correct Login credentials for the root user, "authentication denied" is seen but the login is successful.

login: root
password:
authentication denied
Last login: Tue Nov 19 14:05:32 on ttyu0

--- JUNOS 22.4R3-S2.11 Kernel 64-bit JNPR-12.1-20240313.333b213_buil
root@host_name:~ # cli
{master}
root@host_name-re0>

When logging in to RE0 with incorrect Login credentials for the root user, "authentication denied" is seen, and the login fails.

login: root
password:
authentication denied
Login incorrect
login:

When logging in to the RE1 console, "authentication denied" is not seen, and the login works as expected.

Authentication order configured is : [ tacplus password ]

system {
:
:
    authentication-order [ tacplus password ];
       ports {
           console log-out-on-disconnect;
       }
}

When authentication order configured is "[ tacplus password ]", device will first try Tacplus authentication and if it fails, it will try local authentication.

Tacplus server might be sending "authentication denied" message when root authentication fails at the Tacplus server.
The server message sent by the Tacplus server is printed on the terminal by the device.
After that, device tries local authentication and if successful, root user will be allowed to login.

This is expected behavior as device is printing the server message sent by Tacplus server and proceeding with local authentication.

By default, Tacplus server will not send any server message. But Tacplus server binary can be customized to send the server message.

The message will be printed for RE0 but not for RE1 because RE1 does not have reachability to Tacplus server and there is no packet exchange with Tacplus server.
Device will find there is no reachability and tries local authentication.

Draft v1