That sounds like it’s to be implemented entirely on the side of your SSO master application: When Discourse sends over a user to sign it, it should ask for credentials and redirect back without creating a permanent session.
If your SSO master is an application you’ve developed yourself, you should be able to add this 