Thank you @blake, that’s challanging but tickling 
I’d have to import the passwords from Discourse to the identity hub … oh my.
Helped my original szenario with a 3-stepper: enable email editable, initiate change of email-address, disable email editable. Which seems a bit oversized, but works.
Will think about the sso szenario.