Using reflection in a test to check if a private variable is really null after a function, is this okay?
Personally I wouldn't do this.

The reason why is when your field change name, your test fails because the field is hardcoded there and with refactoring this isn't persisted to the test.

What should I do?

Normally your AuthorizationBeanTest is in the same package as your AuthorizationBean.
When this is correct you could use a protected method.

Example :

protected boolean isUserNull () {
    return user==null;
}


This is completely safe in your pojo, nobody could even acces the User object.
And outside the package no one will ever see this method.

The advantage is when you refactor user or the method name, your test is automatically updated.