GeoFence has multiple PropertyOverrideConfigurer defined, one in geofence-persistence module and another one in gs-geofence-server module. The first one define this locations:
and the second one this locations:
The last one uses GeoServerPropertyOverrideConfigurer which means that the second location will be relative to GeoServer data directory.
The problem here is that since we have multiple PropertyOverrideConfigurer we cannot predict which properties will be used. For example, depending on which PropertyOverrideConfigurer is loaded first we may not use a database user name different from sa.