Never used tacacs but assume it is similar to RADIUS.
Do you have tacacs setup in authentication order?
system authentication-order
You may need to add source address to your tacacs server config to insure the requests from from the address expected by the auth server.
set system tacplus-server 10.*.*.28 source-address 10.0.0.1