The bind configuration property names for auth-server are inconsistent with the rest of CDAP. it currently uses security.auth.server.address, but should be renamed to security.auth.server.bind.address.
And actually it should not be renamed, but the old one deprecated in favor of the new.
Now, the security.auth.server.address property is deprecated and warning message like:
will appear to the logs in case loading deprecated property from resources or set it directly from the code.