It took me two days to find a way to solve this problem.
In my case the web service user had all required privileges to enroll a user. The confusing thing was that the same web service user was able to create a new moodle user via the API.
After checking all those role specific right ("allow roles assignments", "allow role overrides", "allow role switches") multiple times I found one relevant hint in a tutorial: the user who wants to enroll another user to a course has to be member of this course (?!?).
So I put my web service user to each course I have and gave him in addition the "trainer"-role. And now enrollment works even via the API.