oAuth2 authentication plugin
Grab latest version of plugin from link 
Plugin support authentication using:
-
GitHub
-
Bitbucket
-
Google
-
any custom oAuth server
If you want to use GitHub you need an application to be created https://github.com/settings/applications/new. Authorization callback URL should be homepage of TC.
Login as administrator and go to Administration > Authentication
Switch to advanced mode and add module HTTP-OAUTH.v2.
You need to specify your client id, client secret and scope.
For GitHub, user scope is appropriate, account for Bitbucket, and profile email for Google.
If you don’t enable "Allow creating new users on the first login" only users that already exist in Teamcity can login. It means that you need account with the same name as user login name in oauth.
If you specify an "Email Domain", only users whose email is at that domain will be able to log in.
If you specify a value in "Organizations", only users with the specified organizations will be authenticated. You can specify more than one organization by separating them with a comma.
You can decide if you want to hide user/password form on login screen (worth leaving unchecked when you test it).
You can consider to disable also "Allow user registration from the login page" in "Built-in" module.
Save and test out.
Login at your Teamcity host.
Plugin can be build and deployed by gradle deployToTeamcity
Teamcity instance for testing can be setup by docker-compose up