You really can't, at least if you don't have any direct control over the component's source.
You can generate one value, and then use a regex or similar method to test the format while being agnostic of the exact value, but since this is ostensibly random, you would need to run it a near-infinite number of times in order to guarantee that every possible output is valid.
If you do have control over the component, then you should separate out the part that does the authentication with the part that generates a session ID, using composition or inheritance. In the former case, pass in your own generator, and verify that it returns the same (constant) value that your generator does; in the latter case, you write a fake derived class that overrides the generation method and returns a constant value, which you then compare the output to.
This is actually just good design in general, not specifically designing for testability. If this class does the authentication and the session creation and the XML serialization then that's too many responsibilities for one class; instead, separate out each feature into its own class, and if you then need to compose them into a single "Session Authenticator" aggregate, then you can test the aggregate with mocks, since you've already tested the individual components (authentication + session ID + XML serialization + etc.).