code: def _create_authenticator(a_service):
      
      if not isinstance(a_service, sm_messages.Service):
          raise ValueError(u"service is None or not an instance of Service")
  
      authentication = a_service.authentication
      if not authentication:
          _logger.info(u"authentication is not configured in service, "
                       u"authentication checks will be disabled")
          return
  
      issuers_to_provider_ids = {}
      issuer_uri_configs = {}
      for provider in authentication.providers:
          issuer = provider.issuer
          jwks_uri = provider.jwksUri
  
          # Enable openID discovery if jwks_uri is unset
          open_id = jwks_uri is None
          issuer_uri_configs[issuer] = suppliers.IssuerUriConfig(open_id, jwks_uri)
          issuers_to_provider_ids[issuer] = provider.id
  
      key_uri_supplier = suppliers.KeyUriSupplier(issuer_uri_configs)
      jwks_supplier = suppliers.JwksSupplier(key_uri_supplier)
      authenticator = tokens.Authenticator(issuers_to_provider_ids, jwks_supplier)
      return authenticator
docs: Create an instance of :class:`google.auth.tokens.Authenticator`.
  
      Args:
        a_service (:class:`endpoints_management.gen.servicemanagement_v1_messages.Service`): a
          service instance