Master Data Services Silverlight error - silverlight-5.0

Question

I've installed MDS on our dev server and I can navigate through(and perform various functionality such as add users or create, add entities). I can't however get into the "Explorer". In here I get two Silverlight errors.
[HttpWebRequest_WebException_RemoteServer]
Arguements: Not Found
Debugging resource string are unavailable
etc....
The server is Win 2008 R2 Standard
IIS is 6.1 (Build 7601 SP1)
We're running SQL Server 2012
The client is running SL5 and the SL5 SDK
IIS is set up to run SSL and Win Auth(according to the trace logs, this is working, it's getting the principal). Everything else is Disabled
IIS can connect to the DB(via Database Manager in the Management section)
This is happening across all major browsers(IE, chrome, FF).
I have turned on trace logs for MDS(set to Verbose) and I don't see any errors/warnings
I ran SQL profilier as well and didn't see anything that would lead me to believe and error has occurred sql side.
The Event Viewer also doesn't have anything in it related to MDS/Silverlight.
I'm not sure if/how I can remote debug to the MDS website(it's preinstalled and precompiled)
A couple of snippets from the web.config
<bindings>
<wsHttpBinding>
<binding name="mdsWsHttpBinding" maxBufferPoolSize="2147483647" maxReceivedMessageSize="2147483647">
<readerQuotas maxArrayLength="2147483647" maxBytesPerRead="2147483647" maxDepth="2147483647" maxNameTableCharCount="2147483647" maxStringContentLength="2147483647" />
<!--Non-SSL implementations.-->
<security mode="Transport">
<message clientCredentialType="UserName" />
<transport clientCredentialType="Windows">
<extendedProtectionPolicy policyEnforcement="WhenSupported" />
</transport>
</security>
</binding>
</wsHttpBinding>
<basicHttpBinding>
<binding name="mdsBasicHttpBinding" maxBufferPoolSize="2147483647" maxReceivedMessageSize="2147483647">
<readerQuotas maxArrayLength="2147483647" maxBytesPerRead="2147483647" maxDepth="2147483647" maxNameTableCharCount="2147483647" maxStringContentLength="2147483647" />
<!-- Non-SSL implementations.-->
<security mode="TransportCredentialOnly">
<message clientCredentialType="UserName" />
<transport clientCredentialType="Windows">
<extendedProtectionPolicy policyEnforcement="WhenSupported" />
</transport>
</security>
</binding>
</basicHttpBinding>
</bindings>
.. <snip> ...
<system.diagnostics>
<sources>
<!-- Adjust the switch value to control the types of messages that should be logged.
Use the a switchValue of Verbose to generate a full log. Please be aware that
the trace file can get quite large very quickly -->
<source name="MDS" switchType="System.Diagnostics.SourceSwitch" switchValue="All">
<listeners>
<add name="LogFileListener" type="System.Diagnostics.TextWriterTraceListener" initializeData="C:\Program Files\Microsoft SQL Server\110\Master Data Services\WebApplication\trace.log" traceOutputOptions="DateTime" />
<add name="EtwListener" type="System.Diagnostics.Eventing.EventProviderTraceListener, System.Core, Version=3.5.0.0, Culture=neutral, PublicKeyToken=B77A5C561934E089" initializeData="{F2A341B8-CA5F-49ad-B00C-A82D3FCF948B}" />
<remove name="Default" />
</listeners>
</source>
</sources>
<trace autoflush="true" />
If anyone thinks the trace logs will help(or anything else), I can post them up(but they're huge).
My question is:
How can I debug, or somehow get a better error message, to point me in the right direction?
EDIT:
To add I found this in the trace log:
MDS Error: 0 : Service started successfully, Assembly version: 11.0.0.0, file version: 11.0.3000.0 ((SQL11_PCU_Main).121019-1325 )
DateTime=2013-01-07T15:09:14.1660484Z
MDS Error: 0 : ApiContractVersion: 5102
DateTime=2013-01-07T15:09:14.2753968Z
EDIT 2:
I've been able to dig out another error(after many config changes).
at Microsoft.MasterDataServices.Core.BusinessLogic.Member.GetEntityMembers(EntityMembers members, RequestContext context, OperationResult results)
SQL Error Debug Info: Number: 229, Message: The EXECUTE permission was denied on the object 'MemberGetCriteria', database 'MDS', schema 'mdm'., Server: SERVERNAME, Proc: , Line: 0
:
For some reason "MemberGetCriteria" is having some permissions errors.

Answer 1

Two things about permissions with the service account running the application pool in IIS:
1) It must have "Logon as a Batch" rights as per IIS requirements for running an application pool;
2) If you are requiring client certificates on your MDS website, MDS isn't set up to use certificates from the IIS web application to the MDS\Service\service.svc\bhh call, so you will need to make client certificates optional when that service is called.
web.config: I see you set up attempted to set up "Transport" / HTTPS security for the two WCF end-points but left tags instead of tags. You must make sure you did not mix and match the SSL and non-SSL sections and that you only commented the Windows / NTLM (or Kerberos if set up in the back-end) security mode section out, and uncommented the "SSL Implementation" section.