Hi Michelle,
The user would need the 'Read Group Membership' privilege. I believe it is a specific right that would need to be granted that is beyond the 'Read' privilege. It needs the ability to be able to read other users user groups within AD. By default you can always read your own, but you cannot read other users. That is what the AppPool needs to do. For the Web Client, you would need to have the account running the Web Server AppPool have the rights to query AD since that is where the authentication would be taking place for the Web Client since your AppPools are separated.
