Access denied by Business Data Connectivity when trying to add myself to the BDC Metadata Store

Question

Originally I was trying to create a ECT in SharePoint Designer 2010, on the production server, and every attempt fails with the error "Access denied by Business Data Connector" and I found the post "Deploying a BDC Model project to SharePoint 2010"
which suggests that I may not have rights to the BCD Metadata Store: "It seems that an account are you using to deploy solution doesn't have sufficient permission in the BDC Metadata Store."
So I tried to set myself (individual windows user) up to have rights via:  "Central Administration->Application Management->Manage Service Application->Business Data Connectivity Service->Click Set Metada Store Permission
on the ribbon->Set Permission you need and tick the checkbox "Propagate permission to all"; and pressing the OK button an error dialog displays stating Access denied by Business Data Connectivity.
What should I check next?

Answer 1

I'm in a situation similar to MarkDavisHQ's.  I was able to get the Metadata Store working by:
Making the BDC app pool identity a local administrator (before that, I was seeing lots of WcfSendRequeust like this in the logs - but I'm still not sure this escalation was necessary.   I have since removed the app pool identity from local administrators
and it ):
Starting the (SharePoint) Claims to Windows Token Service
Can anyone else confirm whether or not local admin privileges are required?
For those who may be stuck at a similar spot,  here are the log excerpts that helped me.
Before I changed the local admin membership, this was appearing in the logs:
04/22/2012 15:03:26.62    w3wp.exe (0x0FFC)    0x0DF4    SharePoint Foundation    Runtime    tkau    Unexpected    Microsoft.BusinessData.Infrastructure.AccessDeniedException:
Access denied by Business Data Connectivity.    at Microsoft.SharePoint.BusinessData.SharedService.BdcServiceApplicationProxy.Execute[T](String operationName, UInt32 maxRunningTime, ExecuteDelegate`1 operation, Boolean performCanaryCheck, Boolean
isChannelThatDelegatesIdentity)     at Microsoft.SharePoint.BusinessData.SharedService.BdcServiceApplicationProxy.SetAccessControlEntries(MetadataObjectStruct metadataObjectStruct, AccessControlEntryStruct[] aces, String settingId)    
at Microsoft.SharePoint.BusinessData.Infrastructure.BdcAccessControlList.SaveAs(MetadataObjectStruct metadataObjectStruct, String settingId, BdcServiceApplicationProxy serviceProxy)     at Microsoft.SharePoint.BusinessData.Administration.IndividuallySecurableMetadataObject.SetAccessControlList(IAccessControlList
acl, String settingId)     at Microsoft.SharePoint.ApplicationPages.ManageBDCPermissions.OkButton_Click(Object sender, EventArgs e)     at System.EventHandler.Invoke(Object sender, EventArgs e)    
at System.Web.UI.WebControls.Button.OnClick(EventArgs e)     at System.Web.UI.WebControls.Button.RaisePostBackEvent(String eventArgument)     at System.Web.UI.Page.RaisePostBackEvent(IPostBackEventHandler sourceControl,
String eventArgument)     at System.Web.UI.Page.ProcessRequestMain(Boolean includeStagesBeforeAsyncPoint, Boolean includeStagesAfterAsyncPoint)    c448101d-363b-4e70-bac4-3ffb0c3313dc
After I changed the membership, I hit this one (which was resolved by starting the Claims to Windows Token Service ):
04/22/2012 21:50:44.54    w3wp.exe (0x1030)    0x0CF4    SharePoint Foundation    Claims Authentication    bz7l    Medium    SPSecurityContext.WindowsIdentity:
Could not retrieve a valid windows identity for NTName='XYZDEV1\e-hugh.kelley', UPN='[email protected]'. UPN is required when Kerberos constrained delegation is used. Exception: System.ServiceModel.EndpointNotFoundException: There was no endpoint listening
at net.pipe://localhost/s4u/022694f3-9fbd-422b-b4b2-312e25dae2a2 that could accept the message. This is often caused by an incorrect address or SOAP action. See InnerException, if present, for more details. ---> System.IO.PipeException: The pipe endpoint
'net.pipe://localhost/s4u/022694f3-9fbd-422b-b4b2-312e25dae2a2' could not be found on your local machine.      --- End of inner exception stack trace ---    Server stack trace:      at System.ServiceModel.Channels.PipeConnectionInitiator.GetPipeName(Uri
uri)     at System.ServiceModel.Channels.NamedPipeConnectionPoolRegistry.NamedPipeConnectionPool.GetPoolKey(EndpointAddress address, Uri via)     at System.ServiceModel.Channels.CommunicationPool`2.TakeConnection(EndpointAddress
address, Uri via, TimeSpan timeout, TKey& key)     at System.ServiceModel.Channels.ConnectionPoolHelper.EstablishConnection(TimeSpan timeout)     at System.ServiceModel.Channels.ClientFramingDuplexSessionChannel.OnOpen(TimeSpan
timeout)     at System.ServiceModel.Channels.CommunicationObject.Open(TimeSpan timeout)     at System.ServiceModel.Channels.ServiceChannel.OnOpen(TimeSpan timeout)     at System.ServiceModel.Channels.CommunicationObject.Open(TimeSpan
timeout)     at System.ServiceModel.Channels.ServiceChannel.CallOnceManager.CallOnce(TimeSpan timeout, CallOnceManager cascade)     at System.ServiceModel.Channels.ServiceChannel.EnsureOpened(TimeSpan timeout)    
at System.ServiceModel.Channels.ServiceChannel.Call(String action, Boolean oneway, ProxyOperationRuntime operation, Object[] ins, Object[] outs, TimeSpan timeout)     at System.ServiceModel.Channels.ServiceChannelProxy.InvokeService(IMethodCallMessage
methodCall, ProxyOperationRuntime operation)     at System.ServiceModel.Channels.ServiceChannelProxy.Invoke(IMessage message)    Exception rethrown at [0]:      at System.Runtime.Remoting.Proxies.RealProxy.HandleReturnMessage(IMessage
reqMsg, IMessage retMsg)     at System.Runtime.Remoting.Proxies.RealProxy.PrivateInvoke(MessageData& msgData, Int32 type)     at Microsoft.IdentityModel.WindowsTokenService.S4UClient.IS4UService_dup.UpnLogon(String
upn, Int32 pid)     at Microsoft.IdentityModel.WindowsTokenService.S4UClient.<>c__DisplayClass1.<UpnLogon>b__0(IS4UService_dup channel)     at Microsoft.IdentityModel.WindowsTokenService.S4UClient.CallService(Func`2
contractOperation)     at Microsoft.SharePoint.SPSecurityContext.GetWindowsIdentity().    090b18ec-3a6f-4367-a74b-b6a113a62507
04/22/2012 21:50:44.54    w3wp.exe (0x1030)    0x0CF4    SharePoint Foundation    Claims Authentication    g220    Unexpected    No windows identity
for xyzdev1\e-hugh.kelley.    090b18ec-3a6f-4367-a74b-b6a113a62507