def _create_authenticator(a_service):
    """Create an instance of :class:`google.auth.tokens.Authenticator`.

    Args:
      a_service (:class:`endpoints_management.gen.servicemanagement_v1_messages.Service`): a
        service instance
    """
    if not isinstance(a_service, sm_messages.Service):
        raise ValueError(u"service is None or not an instance of Service")

    authentication = a_service.authentication
    if not authentication:
        _logger.info(u"authentication is not configured in service, "
                     u"authentication checks will be disabled")
        return

    issuers_to_provider_ids = {}
    issuer_uri_configs = {}
    for provider in authentication.providers:
        issuer = provider.issuer
        jwks_uri = provider.jwksUri

        # Enable openID discovery if jwks_uri is unset
        open_id = jwks_uri is None
        issuer_uri_configs[issuer] = suppliers.IssuerUriConfig(open_id, jwks_uri)
        issuers_to_provider_ids[issuer] = provider.id

    key_uri_supplier = suppliers.KeyUriSupplier(issuer_uri_configs)
    jwks_supplier = suppliers.JwksSupplier(key_uri_supplier)
    authenticator = tokens.Authenticator(issuers_to_provider_ids, jwks_supplier)
    return authenticator