Hi all,
I hit this roadblock today. 🙁
I have a duplicate ACE on /content/cq:tags and there seems to be no way to remove it.
Here is a screenshot from CRX/DE:

I'm running AEM 6.5.6.0.
When I click the red (-) icon on either one of the duplicate ACL to remove it, I get the following error:
Caused by: org.apache.jackrabbit.oak.api.CommitFailedException: OakAccessControl0013: Duplicate ACE '/content/cq:tags/rep:policy/allow7' found in policy
at org.apache.jackrabbit.oak.security.authorization.accesscontrol.AccessControlValidator.accessViolation(AccessControlValidator.java:309)
at org.apache.jackrabbit.oak.security.authorization.accesscontrol.AccessControlValidator.checkValidPolicy(AccessControlValidator.java:210)
at org.apache.jackrabbit.oak.security.authorization.accesscontrol.AccessControlValidator.checkValidTree(AccessControlValidator.java:162)
at org.apache.jackrabbit.oak.security.authorization.accesscontrol.AccessControlValidator.childNodeChanged(AccessControlValidator.java:140)
at org.apache.jackrabbit.oak.spi.commit.VisibleValidator.childNodeChanged(VisibleValidator.java:113)
at org.apache.jackrabbit.oak.spi.commit.VisibleValidator.childNodeChanged(VisibleValidator.java:30)
at org.apache.jackrabbit.oak.spi.commit.CompositeEditor.childNodeChanged(CompositeEditor.java:121)
at org.apache.jackrabbit.oak.spi.commit.EditorDiff.childNodeChanged(EditorDiff.java:142)
at org.apache.jackrabbit.oak.segment.MapRecord.compare(MapRecord.java:444)
at org.apache.jackrabbit.oak.segment.SegmentNodeState.compareAgainstBaseState(SegmentNodeState.java:651)
at org.apache.jackrabbit.oak.spi.commit.EditorDiff.childNodeChanged(EditorDiff.java:147)
at org.apache.jackrabbit.oak.segment.MapRecord$4.childNodeChanged(MapRecord.java:471)
at org.apache.jackrabbit.oak.segment.MapRecord.compare(MapRecord.java:517)
at org.apache.jackrabbit.oak.segment.MapRecord.compare(MapRecord.java:462)
at org.apache.jackrabbit.oak.segment.SegmentNodeState.compareAgainstBaseState(SegmentNodeState.java:651)
at org.apache.jackrabbit.oak.spi.commit.EditorDiff.childNodeChanged(EditorDiff.java:147)
at org.apache.jackrabbit.oak.segment.MapRecord.compare(MapRecord.java:517)
at org.apache.jackrabbit.oak.segment.SegmentNodeState.compareAgainstBaseState(SegmentNodeState.java:651)
at org.apache.jackrabbit.oak.spi.commit.EditorDiff.process(EditorDiff.java:51)
at org.apache.jackrabbit.oak.spi.commit.EditorHook.processCommit(EditorHook.java:54)
at org.apache.jackrabbit.oak.spi.commit.CompositeHook.processCommit(CompositeHook.java:60)
at org.apache.jackrabbit.oak.segment.scheduler.Commit.apply(Commit.java:99)
at org.apache.jackrabbit.oak.segment.scheduler.LockBasedScheduler.execute(LockBasedScheduler.java:299)
at org.apache.jackrabbit.oak.segment.scheduler.LockBasedScheduler.schedule(LockBasedScheduler.java:270)
at org.apache.jackrabbit.oak.segment.SegmentNodeStore.merge(SegmentNodeStore.java:211)
at org.apache.jackrabbit.oak.core.MutableRoot.commit(MutableRoot.java:251)
at org.apache.jackrabbit.oak.jcr.delegate.SessionDelegate.commit(SessionDelegate.java:346)
at org.apache.jackrabbit.oak.jcr.delegate.SessionDelegate.save(SessionDelegate.java:493)
... 60 common frames omitted
I still have no clue how it's possible to create this.
I see 2 possible options on how it was created, but I haven't investigated further:
Does anyone know a way to remove this duplicate ACE?
Thanks!