Very minor technical note: we can't support this for all providers. The username + password, LDAP, and I think Persona (although see T10125) providers can't initiate a login flow with a redirect (since the user has to type stuff or do javascriptey things, not just navigate to a URI).

All of the OAuth-esque providers can support it, though.

I'm going to support third-party (as here) and OAuth2 (easy) but we have no use cases for other stuff right now (mostly OAuth1 on Twitter/Jira/Bitbucket, I think).

Here's the new AuthProvider code for OAuth2 autologin after D16060:

public function supportsAutoLogin() {
  return true;
}

public function getAutoLoginURI(AphrontRequest $request) {
  $csrf_code = $this->getAuthCSRFCode($request);

  $adapter = $this->getAdapter();
  $adapter->setState($csrf_code);

  return $adapter->getAuthenticateURI();
}

I'd expect Kerberos to be similar, although likely with a simpler getAutoLoginURI() method.