Thanks, @purldator. That’s an interesting workaround. I have no idea how to implement it, but I see what you’re getting at and it makes sense.
@riking, That’s what I was afraid of. Thank you for explaining why the secret needs to stay a secret. It’s very helpful to know the risks.
This is beyond the scope of WordPress, but would another potential route be to add a user level sso secret in Discourse–something like to the user API key?
As it relates to WordPress, the cleanest way would be to add better Network Plugin support. There are a few other settings that make sense to manage network-wide, so perhaps someone with more dev skills than I runs into similar issues.