The nonce has to be generated by Discourse. This is important for security.
Without the nonce, the SSO payload would in effect be a “golden ticket” 
that could always be used to sign in that user, even if he changed his password, his account in the SSO source got disabled, …
The nonce ensures that the SSO payload is a fresh response to the authentication request made by Discourse.
If you want the user to be signed into Discourse automatically, there are two easy ways:
- Have Discourse be
login required. Then, although the login will technically only happen once the user tries to access Discourse, the SSO process can be fully transparent to the user. - Embed an
iframethat points to Discourse to start the SSO process (I think the right URL is/session/sso, but I’m not sure). Discourse will then generate the nonce and redirect to your app, which has to recognize the user by a cookie and redirect back with the corresponding SSO payload to close the deal.