In addition to the roles mentioned in the documentation, the iam.oauthClientViewer role should be added. With these three roles, we were able to connect using IAM authentication from our Dataflow job. An update to the documentation would be appreciated :)