This article explains how a user needs to be configured to be authenticated from TACACS.

A TACACS authenticated user configured with UID, permissions, and a local authentication password is unable to login to the CLI and "Access Denied" message is seen.

In order to configure a user to be authenticated by TACACS, add the configuration as follows:

1. Assign a login class to TACACS+-authenticated users who do not have a locally defined user account.
2. You configure a user template account in the same way as a local user account, except that you do not configure a local authentication password because the TACACS+ server authenticates the user. If local authentication password is configured, it needs to be removed for user to be authenticated by the server.

• To use the same permissions for all TACACS+-authenticated users, configure the remote user template.

[edit groups global system login]
user@host# set user remote class <class>

For example:

[edit groups global system login]
user@host# set user remote class super-user

• To use different login classes for different TACACS+-authenticated users, granting them different permissions:

a. Create multiple user templates in the Junos OS configuration. For example:

[edit groups global system login]
user@host# set user RO class read-only
user@host# set user OP class operator
user@host# set user SU class super-user
user@host# set user remote full-name "default remote access user template"
user@host# set user remote class read-only

b. Configure the TACACS+ server to map the authenticated user to the appropriate user template. For example, set the local-user-name Juniper vendor-specific attribute (VSA) to the name of a user template configured on the device, which in the previous example is RO, OP, or SU. Authentication fails if the device cannot assign a user to a local user account or user template and the remote user template is not configured.

https://www.juniper.net/documentation/us/en/software/junos/user-access/topics/topic-map/user-access-tacacs-authentication.html