Yeah that’s actually the way I used to implement it now.
Sending the user through the SSO, the Middleware creates a simple user with name, email and a token array, creates a token, passes it back to the SPA.
The middleware proxies the requests to discourse with an all user API key and validates the “session token” (to see which user it is) and some other security magic.
To let the user stay logged in I will use a cookie / local storage and will sync the logout via the logout direct option of discourse.
It works, but I still believe there should be a better option than handling with an admin API token in combination with a username. It breaks if some admin will change the username of someone… I would like a hash ID or something like that… But nothing I can change, so I will live with it 
Thanks for your answer.