Note that the iframe won’t work if Discourse is running on an unrelated domain, as browsers will consider these cookies to be third-party cookies 
An alternative is to make sure that all links to the forum point to /session/sso while the user is authenticated in the parent site.