I would recommend avoiding trying to implement SSO directly in Prodigy or via an additional application, as that can get rather complicated.
Instead I would suggest using a proxy in front of Prodigy, such as the oauth2 proxy. This has the nice benefit of already being containerized which should make getting it setup a little easier.