The second option is a world of pain, because there are a ton of edge cases in using an external user database, most of which are already handled beautifully by Discourse’s SSO implementation.
Go for option one, and build a thin app to handle SSO. Remember that your users don’t have to know about SSO at all – you can style the login prompt as you wish to make this all seamless 