diff --git a/src/applications/auth/controller/PhabricatorAuthOneTimeLoginController.php b/src/applications/auth/controller/PhabricatorAuthOneTimeLoginController.php
--- a/src/applications/auth/controller/PhabricatorAuthOneTimeLoginController.php
+++ b/src/applications/auth/controller/PhabricatorAuthOneTimeLoginController.php
@@ -119,38 +119,9 @@
         }
       unset($unguarded);
 
-      $next = '/';
-      if (!PhabricatorPasswordAuthProvider::getPasswordProvider()) {
-        $next = '/settings/panel/external/';
-      } else {
-
-        // We're going to let the user reset their password without knowing
-        // the old one. Generate a one-time token for that.
-        $key = Filesystem::readRandomCharacters(16);
-        $password_type =
-          PhabricatorAuthPasswordResetTemporaryTokenType::TOKENTYPE;
-
-        $unguarded = AphrontWriteGuard::beginScopedUnguardedWrites();
-          id(new PhabricatorAuthTemporaryToken())
-            ->setTokenResource($target_user->getPHID())
-            ->setTokenType($password_type)
-            ->setTokenExpires(time() + phutil_units('1 hour in seconds'))
-            ->setTokenCode(PhabricatorHash::weakDigest($key))
-            ->save();
-        unset($unguarded);
-
-        $panel_uri = '/auth/password/';
-
-        $next = (string)id(new PhutilURI($panel_uri))
-          ->setQueryParams(
-            array(
-              'key' => $key,
-            ));
-
-        $request->setTemporaryCookie(PhabricatorCookies::COOKIE_HISEC, 'yes');
-      }
+      $next_uri = $this->getNextStepURI($target_user);
 
-      PhabricatorCookies::setNextURICookie($request, $next, $force = true);
+      PhabricatorCookies::setNextURICookie($request, $next_uri, $force = true);
 
       $force_full_session = false;
       if ($link_type === PhabricatorAuthSessionEngine::ONETIME_RECOVER) {
@@ -206,4 +177,57 @@
 
     return id(new AphrontDialogResponse())->setDialog($dialog);
   }
+
+  private function getNextStepURI(PhabricatorUser $user) {
+    $request = $this->getRequest();
+
+    // If we have password auth, let the user set or reset their password after
+    // login.
+    $have_passwords = PhabricatorPasswordAuthProvider::getPasswordProvider();
+    if ($have_passwords) {
+      // We're going to let the user reset their password without knowing
+      // the old one. Generate a one-time token for that.
+      $key = Filesystem::readRandomCharacters(16);
+      $password_type =
+        PhabricatorAuthPasswordResetTemporaryTokenType::TOKENTYPE;
+
+      $unguarded = AphrontWriteGuard::beginScopedUnguardedWrites();
+        id(new PhabricatorAuthTemporaryToken())
+          ->setTokenResource($user->getPHID())
+          ->setTokenType($password_type)
+          ->setTokenExpires(time() + phutil_units('1 hour in seconds'))
+          ->setTokenCode(PhabricatorHash::weakDigest($key))
+          ->save();
+      unset($unguarded);
+
+      $panel_uri = '/auth/password/';
+
+      $request->setTemporaryCookie(PhabricatorCookies::COOKIE_HISEC, 'yes');
+
+      return (string)id(new PhutilURI($panel_uri))
+        ->setQueryParams(
+          array(
+            'key' => $key,
+          ));
+    }
+
+    $providers = id(new PhabricatorAuthProviderConfigQuery())
+      ->setViewer($user)
+      ->withIsEnabled(true)
+      ->execute();
+
+    // If there are no configured providers and the user is an administrator,
+    // send them to Auth to configure a provider. This is probably where they
+    // want to go. You can end up in this state by accidentally losing your
+    // first session during initial setup, or after restoring exported data
+    // from a hosted instance.
+    if (!$providers && $user->getIsAdmin()) {
+      return '/auth/';
+    }
+
+    // If we didn't find anywhere better to send them, give up and just send
+    // them to the home page.
+    return '/';
+  }
+
 }
diff --git a/src/applications/auth/query/PhabricatorAuthProviderConfigQuery.php b/src/applications/auth/query/PhabricatorAuthProviderConfigQuery.php
--- a/src/applications/auth/query/PhabricatorAuthProviderConfigQuery.php
+++ b/src/applications/auth/query/PhabricatorAuthProviderConfigQuery.php
@@ -6,11 +6,7 @@
   private $ids;
   private $phids;
   private $providerClasses;
-
-  const STATUS_ALL = 'status:all';
-  const STATUS_ENABLED = 'status:enabled';
-
-  private $status = self::STATUS_ALL;
+  private $isEnabled;
 
   public function withPHIDs(array $phids) {
     $this->phids = $phids;
@@ -22,40 +18,26 @@
     return $this;
   }
 
-  public function withStatus($status) {
-    $this->status = $status;
+  public function withProviderClasses(array $classes) {
+    $this->providerClasses = $classes;
     return $this;
   }
 
-  public function withProviderClasses(array $classes) {
-    $this->providerClasses = $classes;
+  public function withIsEnabled($is_enabled) {
+    $this->isEnabled = $is_enabled;
     return $this;
   }
 
-  public static function getStatusOptions() {
-    return array(
-      self::STATUS_ALL      => pht('All Providers'),
-      self::STATUS_ENABLED  => pht('Enabled Providers'),
-    );
+  public function newResultObject() {
+    return new PhabricatorAuthProviderConfig();
   }
 
   protected function loadPage() {
-    $table = new PhabricatorAuthProviderConfig();
-    $conn_r = $table->establishConnection('r');
-
-    $data = queryfx_all(
-      $conn_r,
-      'SELECT * FROM %T %Q %Q %Q',
-      $table->getTableName(),
-      $this->buildWhereClause($conn_r),
-      $this->buildOrderClause($conn_r),
-      $this->buildLimitClause($conn_r));
-
-    return $table->loadAllFromArray($data);
+    return $this->loadStandardPage($this->newResultObject());
   }
 
-  protected function buildWhereClause(AphrontDatabaseConnection $conn) {
-    $where = array();
+  protected function buildWhereClauseParts(AphrontDatabaseConnection $conn) {
+    $where = parent::buildWhereClauseParts($conn);
 
     if ($this->ids !== null) {
       $where[] = qsprintf(
@@ -78,22 +60,14 @@
         $this->providerClasses);
     }
 
-    $status = $this->status;
-    switch ($status) {
-      case self::STATUS_ALL:
-        break;
-      case self::STATUS_ENABLED:
-        $where[] = qsprintf(
-          $conn,
-          'isEnabled = 1');
-        break;
-      default:
-        throw new Exception(pht("Unknown status '%s'!", $status));
+    if ($this->isEnabled !== null) {
+      $where[] = qsprintf(
+        $conn,
+        'isEnabled = %d',
+        (int)$this->isEnabled);
     }
 
-    $where[] = $this->buildPagingClause($conn);
-
-    return $this->formatWhereClause($conn, $where);
+    return $where;
   }
 
   public function getQueryApplicationClass() {