In vCenter SSO 6.x, SSO domain name can be anything as opposed to vsphere.local in 5.5.
There is a default tenant in SSO with vSphere SSO domain name. For example, if vSphere SSO domain name is vsphere.dev then there is a default tenant vsphere.dev. When STS url does not specify tenant name, retrieve token should go to default tenant.
This issue occurs due to a bug. When non default domain/tenant is used for SSO, STS takes the default value vsphere.local.