tacacs-server optional-passwords — global
tacacs-server optional-passwords no tacacs-server optional-passwords
This command makes the user’s password optional, depending on the TACACS server’s configuration. When this feature is enabled, the router tries to authenticate the user with the username only. If that fails, the router tries again with both the username and password.
This command is for TACACS and extended TACACS only; it does not work with TACACS+.