The cause of this bug is not obvious. In the upgrade/downgrade cycle for HDP-2.2 upgrade to HDP-2.4 downgrade to HDP-2.2, the Metastore upgrade_schema method will invoke configure(). This in turn creates (correctly) /usr/hdp/current/hive-metastore/conf/conf.server to place configs. The bug is that upgrade_schema happens BEFORE hdp-select is called, so the directory is created within HDP-2.2. Then on downgrade, that directory is left intact.
The alert checks for existence of conf/conf.server as an indication of where to look for configs. Since that directory is incorrect for HDP-2.2, the wrong configs are loaded when running the alert script. This is an issue when security is enabled since the wrong configs are now checked.
The fix is to invoke upgrade_schema AFTER hdp-select instead of before. That way, the conf/conf.server directory is created in the correct directory in the version that supports it.