Actually it was not.
Basic informations as email and some name isn’t sensitive data in Europe. In Turkey perhaps, but situation there is somekind hairy anyway. But the most important thing to understand is that your Discourse is not sending needed login data to SSO. Your Discourse is getting that data from SSO.
All you need to worry about is not to sell/give that data any further. You can store it to your needs, though. Where you store all user data depends in the meaning if you may violate GDPR. If you are following GDPR then you have to be sure that services you are using (as Google, Discourse as company, email prosessor etc) are following GDPR. These companies mostly do.
But as said, email and name is not such sensitive information that GDPR is regulating. You can collect those from your users, if needed, like to create user accounts. But you can’t use those, like emails, as you want. Using is regulated.
If you start collecting home addresses, work places, even marriage statuses, without reason, you break against GDPR.
So, the information you needed, but for some reasoon you don’t like it, is SSO has absolut nothing to with GDPR and EU regulations. Of course you should tell that in your security statement, but that is all.