code: func newAuthenticatorFromOIDCIssuerURL(opts oidc.Options) (authenticator.Token, error) {
  	const noUsernamePrefix = "-"
  
  	if opts.UsernamePrefix == "" && opts.UsernameClaim != "email" {
  		// Old behavior. If a usernamePrefix isn't provided, prefix all claims other than "email"
  		// with the issuerURL.
  		//
  		// See https://github.com/kubernetes/kubernetes/issues/31380
  		opts.UsernamePrefix = opts.IssuerURL + "#"
  	}
  
  	if opts.UsernamePrefix == noUsernamePrefix {
  		// Special value indicating usernames shouldn't be prefixed.
  		opts.UsernamePrefix = ""
  	}
  
  	tokenAuthenticator, err := oidc.New(opts)
  	if err != nil {
  		return nil, err
  	}
  
  	return tokenAuthenticator, nil
  }
docs: // newAuthenticatorFromOIDCIssuerURL returns an authenticator.Token or an error.