feat: add Azure DevOps enterprise integration support

[zerofltexx]

• This change is worth documenting at https://docs.all-hands.dev/
• Include this change in the Release Notes. If checked, you must provide an end-user friendly description for your change below

End-user friendly description

This PR adds enterprise/SaaS support for Azure DevOps integration. It builds on top of /pull/11243 PR by adding SSO authentication, user identity mapping, and webhook security features required for multi-tenant SaaS deployment.

---

Summary

This PR extends the base Azure DevOps integration PR with enterprise-specific features.

What This PR Adds

1. SSO Integration

• Keycloak identity provider configuration
• Automatic background enrichment on user login

2. User Identity Resolution

• Resolves Azure AD Object ID → Azure DevOps User ID via Graph API
• Stores mapping in Keycloak user attributes (azure_devops_id)
• Why needed: Webhook payloads contain Azure DevOps User IDs (VSID), not Azure AD IDs. Without this mapping, we can't identify which OpenHands user triggered the webhook.

3. Webhook Security

• Webhook verification using (organization, subscriptionId, api_key) lookup
• Deduplication using Redis

4. Enterprise Service Implementation

• Extends base AzureDevOpsServiceImpl with SaaS-specific features
• Adds dual authentication support (OAuth JWT + PAT auto-detection)
• Token manager integration for multi-user environments

5. Webhook Event Processing

• Processes work item and PR comment webhooks
• AI solvability analysis for work items
• Acknowledgment messages posted back to Azure DevOps
• User identity resolution from webhook payloads

Prerequisite
Please follow the README.md in All-Hands-AI/OpenHands-Cloud/pull/238

Azure DevOps (Client side - unfortunately this can't be automated based on my research)

• Add the application to ADO, this is easy if the app is within the same tenant for OH cloud self hosted case but for OH customers need to create an enterprise application from a multitenant application

• Create an API key. Have this ready for the next step

• Create the webhook, since it is at project level, this pair needs to be created in every project. In HTTP headers paste the API key like so:

To-do

• Test webhook API key method
• OpenHands-Cloud ADO PR
• Test auto discover Organization from SSO

Related Issues

• Azure DevOps support All-Hands-AI/OpenHands-Cloud#39

[zerofltexx]

Fix: Mainly to rename Azure DevOps webhook table migration (083 -> 084). New migration file took over 83 & merged to main before this one.

• Clean up unused columns from webhook model
• Extract duplicate user lookup logic to _resolve_keycloak_user_id()
• Standardize logging prefixes to [Azure DevOps]
• Return 400 status codes for webhook errors (matching GitLab pattern)
• Add module-level TokenManager instance
• Fix auto-login for Azure DevOps users
• Remove duplicate import in auth.py

The failed test is due to this

[neubig]

Hi, just a note, I'll circle back to reviewing this next week after we (hopefully) finish with shipping OpenHands v1 to the OpenHands cloud.

[neubig]

We've shipped v1 so I'll be QAing this soon.

[zerofltexx]

Updates:

• Added V1 callback processor support for Azure DevOps (matching GitHub's V1 patterns)
• Added Azure DevOps button on the new login screen
• Added support for workitem.created webhook event type
• Bumped migration number from 090 → 091 to resolve conflict with upstream main

Despite my best attempt, I can't make v1 work on my test environment, so I didn't test for said version. v0 works flawlessly still. Database already set to use v1, but there's a specific runtime-api & runtime pair needed? Appreciate some help on this then I can help test v1.

[github-actions]

This PR is stale because it has been open for 40 days with no activity. Remove the stale label or leave a comment, otherwise it will be closed in 10 days.

[github-actions]

This PR was closed because it had no activity for 50 days. If you feel this was closed in error, and you would like to continue the PR, please resubmit or let us know.