Access a privileged shell.
Run the following command:
# mysql ssg -u gateway -p -e "select name from policy where xml like \"%L7p:DecodeJsonWebToken%\""
Make note of the results. They list all the policies and services that contain the assertion.
Log in to the Policy Manager either as the administrator or as someone with permissions to modify all policies/services.
Open a policy that is identified by the MySQL command above.
Press Ctrl-F to invoke the Search bar and then type "Decode JSON Web Token” to show all instances of the assertion in the policy.
Click a search hit to go to the line in the policy.
Add the Compare Expression Assertion in the appropriate place. This is described next.

Decode JSON Web Token Assertion in Default Policy: 

In this case, simply place the Compare Expression assertion immediately after the Decode JSON Web Token assertion.

Decode JSON Web Token inside an ‘All assertions must evaluate to true’ Assertion:

 Similar to the above, place the Compare Expression assertion within "All assertions...", immediately following the Decode JSON Web Token assertion.

Decode JSON Web Token inside an ‘At least one assertion must evaluate to true’ Assertion:

In this instance, enclose both the Decode JSON Web Token and Compare Expression assertions within a new "All assertions must evaluate to true" assertion.

Before:

At least one assertion must evaluate to true
  ...
  Decode JSON Web Token
  ...

After:

At least one assertion must evaluate to true
  ...
  All assertions must evaluate to true
    ...
    Decode JSON Web Token
    Compare Expression
    ...

<l7:Mapping action="NewOrExisting" srcId="
<unique_ID>" srcUri="http://
<IP_address>:8080/restman/1.0/firewallRules/
<identifier>" type="FIREWALL_RULE"/>

<l7:Mapping action="NewOrExisting" srcId="
<unique_ID>" srcUri="http://
<IP_address>:8080/restman/1.0/firewallRules/
<identifier>" type="FIREWALL_RULE">
   <l7:Properties>
      <l7:Property key="
MapBy">
         <l7:StringValue>
name</l7:StringValue>
      </l7:Property>
   </l7:Properties>
</l7:Mapping>

In the Policy Manager, run the Manage Listen Ports task.
Double-click on port 
9443
 and then navigate to the SSL/TLS Settings tab.
Make a note of all the cipher suites enabled for this port.
Click 
Use Default List
 and then 
OK
.
Repeat steps 2 to 4 for ports 
2124
 and 
8443
.
Exit the Manage Listen Ports task when done.

In the [Security] tab, the Service Authentication is “Use HTTP Credentials from Request”.
The backend services returns a 401 HTTP error.

Create a database on the localhost.
Dump the database to a file using
mysqldump
.
Create an empty database in the Azure Database for the MySQL instance.
Create the
gateway@%
user on the AzureSQL for MySQL instance with the same rights as on the local instance.
Load the dump using this command:
mysql ssg -h [host] -u [rootuser] -p < dumpfile.sql

auth        required      pam_tally2.so deny=5 even_deny_root_account onerr=fail unlock_time=1200 root_unlock_time=1200
auth        required      pam_env.so
account     required      pam_tally2.so
auth        sufficient    pam_unix.so try_first_pass
auth        requisite     pam_succeed_if.so uid >= 500 quiet
auth        required      pam_deny.so