I only now realised that an alternative for building SCIM endpoints into Camunda (which we did) is to setup a local OpenLDAP server, add SCIM support for that and the use Camunda LDAP plugin for user and group identities, and then Spring Security OpenID Connect for authentication.
And already the first Google search for that gave me a promising example: https://www.tirasa.net/en/blog/scim-to-provision-users-from-azure-active-directory-to-openldap