This took a while to find, so sending here to document. ScreenOS 6+
will authenticate via TACACS+.
Necessary tac_plus.cfg snippet:
service = netscreen {
vsys = root
privilege = read-write
}