New Participant

How to fix OakAccessControl0013: Duplicate ACE

Forum|Forum|5 years ago
September 16, 2020
5 replies
1733 views

Hi all,

I hit this roadblock today. 🙁

I have a duplicate ACE on /content/cq:tags and there seems to be no way to remove it.

Here is a screenshot from CRX/DE:

I'm running AEM 6.5.6.0.

When I click the red (-) icon on either one of the duplicate ACL to remove it, I get the following error:

Caused by: org.apache.jackrabbit.oak.api.CommitFailedException: OakAccessControl0013: Duplicate ACE '/content/cq:tags/rep:policy/allow7' found in policy
        at org.apache.jackrabbit.oak.security.authorization.accesscontrol.AccessControlValidator.accessViolation(AccessControlValidator.java:309)
        at org.apache.jackrabbit.oak.security.authorization.accesscontrol.AccessControlValidator.checkValidPolicy(AccessControlValidator.java:210)
        at org.apache.jackrabbit.oak.security.authorization.accesscontrol.AccessControlValidator.checkValidTree(AccessControlValidator.java:162)
        at org.apache.jackrabbit.oak.security.authorization.accesscontrol.AccessControlValidator.childNodeChanged(AccessControlValidator.java:140)
        at org.apache.jackrabbit.oak.spi.commit.VisibleValidator.childNodeChanged(VisibleValidator.java:113)
        at org.apache.jackrabbit.oak.spi.commit.VisibleValidator.childNodeChanged(VisibleValidator.java:30)
        at org.apache.jackrabbit.oak.spi.commit.CompositeEditor.childNodeChanged(CompositeEditor.java:121)
        at org.apache.jackrabbit.oak.spi.commit.EditorDiff.childNodeChanged(EditorDiff.java:142)
        at org.apache.jackrabbit.oak.segment.MapRecord.compare(MapRecord.java:444)
        at org.apache.jackrabbit.oak.segment.SegmentNodeState.compareAgainstBaseState(SegmentNodeState.java:651)
        at org.apache.jackrabbit.oak.spi.commit.EditorDiff.childNodeChanged(EditorDiff.java:147)
        at org.apache.jackrabbit.oak.segment.MapRecord$4.childNodeChanged(MapRecord.java:471)
        at org.apache.jackrabbit.oak.segment.MapRecord.compare(MapRecord.java:517)
        at org.apache.jackrabbit.oak.segment.MapRecord.compare(MapRecord.java:462)
        at org.apache.jackrabbit.oak.segment.SegmentNodeState.compareAgainstBaseState(SegmentNodeState.java:651)
        at org.apache.jackrabbit.oak.spi.commit.EditorDiff.childNodeChanged(EditorDiff.java:147)
        at org.apache.jackrabbit.oak.segment.MapRecord.compare(MapRecord.java:517)
        at org.apache.jackrabbit.oak.segment.SegmentNodeState.compareAgainstBaseState(SegmentNodeState.java:651)
        at org.apache.jackrabbit.oak.spi.commit.EditorDiff.process(EditorDiff.java:51)
        at org.apache.jackrabbit.oak.spi.commit.EditorHook.processCommit(EditorHook.java:54)
        at org.apache.jackrabbit.oak.spi.commit.CompositeHook.processCommit(CompositeHook.java:60)
        at org.apache.jackrabbit.oak.segment.scheduler.Commit.apply(Commit.java:99)
        at org.apache.jackrabbit.oak.segment.scheduler.LockBasedScheduler.execute(LockBasedScheduler.java:299)
        at org.apache.jackrabbit.oak.segment.scheduler.LockBasedScheduler.schedule(LockBasedScheduler.java:270)
        at org.apache.jackrabbit.oak.segment.SegmentNodeStore.merge(SegmentNodeStore.java:211)
        at org.apache.jackrabbit.oak.core.MutableRoot.commit(MutableRoot.java:251)
        at org.apache.jackrabbit.oak.jcr.delegate.SessionDelegate.commit(SessionDelegate.java:346)
        at org.apache.jackrabbit.oak.jcr.delegate.SessionDelegate.save(SessionDelegate.java:493)
        ... 60 common frames omitted

I still have no clue how it's possible to create this.

I see 2 possible options on how it was created, but I haven't investigated further:

this is created after doing a partial sidegrade using crx2oak without importing users and/or groups
this is created by running the purgeAllAuthorizablesFromConfiguration() and/or apply() methods from the Netcentric Access Control Tool JMX bean

Does anyone know a way to remove this duplicate ACE?

Thanks!