Hi, let’s see if I can help a bit (but I’m not an expert in navigating Google Cloud Console…).
When you say “created an IAM service”, do you mean a Service Account?
The way I had it set up for testing was using a Service Account for which I created an API key. I gave the service account access to my Google Analytics property.
First, I used my Google account to create a project under our organization.
While having the project selected in the top bar:
- I enabled “Google Analytics Admin API” and “Google Analytics Data API” unter “APIs & Services” → “Enabled APIs & services”.
- I created a service account under “IAM & Admin”. Note down the very long service account email address. When you select the new service account, it has a “Keys” tab, where I created a new (private) key (gives the option for JSON and P12).
Over on https://analytics.google.com:
- Select the relevant Analytics Account
- Select the relevant Analytics Property
- Go to Admin in the lower left corner
- Go to “Property settings” (collapsible menu) → “Property” → “Property access management”, a slideout opens from the right-hand side
- “+” to add a user
- Enter the long service account email address, “Viewer” standard role
These are the steps I was able to retrace from when I set it up last year.
Maybe the client did not give access to the service account email address (in case you used that)?
Btw, in case you run into Quota limitations using the built-in KNIME OAuth client ID, you might need to set up your own OAuth client ID, as detailed in this helpful post: URGENT ISSUE| GA Authentication | Interactive | quota exceeded - #19 by Gavin_Attard
Let me know if that helps, otherwise I can try to diagnose further 
Best,
Manuel