Well this article is very valuable and answers most of my questions about the reasons for
httpd and ipaapi service separation.
Finally the ccache with the TGT is destoyed and the
cookie is returned to the user.
So in the server-side process, the Ticket Granting Ticket (TGT) is obtained (your link to
class login_password), but it is then discarded after acquiring the LDAP service ticket
and setting the cookie. Consequently, if you possess an "ipa_session" cookie
that is somehow linked to a particular service ticket for ldap in the
"/run/ipa/ccaches" directory, the authorization code (which executes the
"kinit" process) is not executed.
Thank you, I think the pieces of the puzzle are falling into place now.