Do not wipe out Shibboleth credentials on logout.

- Thanks to @Cloud8 and @lahmann
- Resolves PR #612.

module/VuFind/src/VuFind/Auth/Shibboleth.php

@@ -121,9 +121,21 @@ class Shibboleth extends AbstractBase
             }
         }
 
-        // Save credentials if applicable:
+        // Save credentials if applicable. Note that if $catPassword is empty,
+        // we'll pass through the existing password already in the database;
+        // otherwise, when users log out, their passwords may be cleared from
+        // the database. We can't simply skip saving credentials when the password
+        // is empty, because in some scenarios, an empty password is normal.
+        // Note that this leaves an edge case where, if a user changes their
+        // password from something to nothing, VuFind will not properly clear it
+        // out. This seems unlikely, but if it is encountered, we may need to
+        // add more logic here. See https://github.com/vufind-org/vufind/pull/612
+        // for related discussion.
         if (!empty($user->cat_username)) {
-            $user->saveCredentials($user->cat_username, $catPassword);
+            $user->saveCredentials(
+                $user->cat_username,
+                empty($catPassword) ? $user->cat_password : $catPassword
+            );
         }
 
         // Save and return the user object: