I think your relationship is actually many to one, not one to one i.e. many users will belong to one department.
So, in your userxml.hbm.xml file, change the relation to:
As a side issue, consider dropping the XML suffix from your class names. It doesn't follow standards and obscures their meaning. For example, your UserXML represents a User, your DepartmentXML a department.