TACACS sends the Authorization packet first.
Example:
VyOS: 192.168.139.145
TACACS Server: 192.168.139.146
Key: gns3
user: gns3
password: gns3

VyOS configuration:

set system login tacacs server 192.168.139.146 key 'gns3'

The first packet must be Authentication.
Private TACACS Servers (Aruba ClearPass) send FAIL as an answer, with the reason that the user should be authenticated first.
It drops the connection, and VyOS does not send authentication packets.