Error "Failed to set up STS system tenant" while performing convergance via vSphere Web Client failing during vmidentity firstboot

Products

• VMware

Issue/Introduction

Symptoms:

• Converging a vCenter Server instance with an external Platform Services Controller to a vCenter Server instance with an embedded Platform Services Controller fails with STS system tenant error.
• Converging a vCenter Server instance with an external Platform Services Controller to a vCenter Server instance with an embedded Platform Services Controller by using vCenter Server Appliance HTML5 Web Client might fail with an error similar to "Failed to set up STS system tenant". The failure happens during firstboot.
• In the converge.log, you see message similar to:

2019-08-20T15:19:45.13Z INFO converge VECS entries created for custom solution users.
2019-08-20T15:19:45.14Z INFO converge Stopping the service vmware-vmon ...
2019-08-20T15:19:46.350Z INFO converge Stopped vmware-vmon
2019-08-20T15:19:46.350Z INFO converge Running Firstboots for : vmon-firstboot,rhttpproxy_firstboot,lookupsvc-firstboot
2019-08-20T15:20:00.880Z INFO converge Running Firstboots for : vmidentity-firstboot
2019-08-20T15:20:21.517Z ERROR converge Failed to run white listed firstboot scripts. Error: {
    "detail": [
        {
            "translatable": "An error occurred while invoking external command : '%(0)s'",
            "args": [
                "Command: ['run-firstboot-scripts', '--action', 'firstboot', '--subaction', 'firstboot', '--fbWhiteList', 'vmidentity-firstboot']\nStderr: "
            ],
            "id": "install.ciscommon.command.errinvoke",
            "localized": "An error occurred while invoking external command : 'Command: ['run-firstboot-scripts', '--action', 'firstboot', '--subaction', 'firstboot', '--fbWhiteList', 'vmidentity-firstboot']\nStderr: '"
        }
    ],
    "problemId": null,
    "componentKey": null,
    "resolution": null
}
2019-08-20T15:20:21.526Z INFO converge Unsetting the converge running flag
2019-08-20T15:20:21.531Z INFO converge Cleanup successful with partial flag = True.

Note: The preceding log excerpts are only examples. Date, time, and environmental variables may vary depending on your environment.

Cause

The vCSA repository is pointing to latest released a vCSA 6.7 repository. Converge process using latest released RPM's from repository which is not compatible with vCSA installed version. Downloaded rpm's for converge not compatible with the installed vCSA version so first boots script fails.

Resolution

This issue is resolved in VMware vCenter Server 6.7 U3b, available at VMware Downloads .

Workaround:
To resolve the issue: 

1. Mount the same build ISO to do the convergence.
2. Change the repository.
   1. Log into the VAMI page(https://vcsa_fqdn:5480).
   2. Under the Update tab > Click on Settings and use the CD/DVD ISO for picking up the repository.
3. Take a snapshot of the vCSA.
4. Login to vCSA through putty.
5. Run the command to delete files from previous convergence attempt:

# rm -rf /root/velma/*.json
# rm -rf /storage/log/vmware/converge/

6. Run the convergence process again.

Note: See Download and Mount the vCenter Server Appliance Installer for UI Convergence