Thanks to the confirmation by Délawen that my approach is correct in general, I was fiddling about the security check a bit further.
GeoNetwork does two 302 redirects redirects before returning the correct JSESSIONID with the response. Somehow, the Set-Cookie header from this response is not correctly transferred, if I use default follow redirect option of HttpURLConnection.
If I follow the redirects manually, I get a valid JSESSIONID after the last redirect.
Here my manual redirect output, in case it is relevant to somebody:
(Interestingly, the intermediate JSESSIONID is not valid for private access and there is a referring parameter failure=true, but the final operation is sucessful anyway.)
Sending 'POST' request to URL : http://localhost:8080/geonetwork/j_spring_security_check
Response Code : 302
Location: http://localhost:8080/geonetwork/login.jsp;jsessionid=8BE9A26FDB257A666AD016DA055FAA54?node=srv&failure=true
Set-Cookie response: [JSESSIONID=8BE9A26FDB257A666AD016DA055FAA54; Path=/geonetwork/; HttpOnly]
Sending 'POST' request to URL : http://localhost:8080/geonetwork/login.jsp;jsessionid=8BE9A26FDB257A666AD016DA055FAA54?node=srv&failure=true
Response Code : 302
Location: /geonetwork/srv/eng/catalog.signin;jsessionid=8BE9A26FDB257A666AD016DA055FAA54?node=srv&failure=true
Set-Cookie response: null
Sending 'POST' request to URL : http://localhost:8080/geonetwork/srv/eng/catalog.signin;jsessionid=8BE9A26FDB257A666AD016DA055FAA54?node=srv&failure=true
Response Code : 200
Set-Cookie response: [sessionExpiry=1489669687323; Path=/, serverTime=1489669687323; Path=/, JSESSIONID=F7296382C6CEEF3A41130B208597E5EC; Path=/geonetwork/; HttpOnly]
So what I now do is to request http://localhost:8080/geonetwork/srv/eng/catalog.signin directly and so far it works good. I hope, it's not a temporary endpoint that changes frequently.
EDIT:
My current POST login request just uses the credentials in the Authorization header. I don't send anything in the body so I also don't need the Content-Type header.
After testing this again, somehow, querying the catalog.signin endpoint didn't work for me now, when I want to use the response JSESSIONID to login to GeoNetwork.
What I had to do is to query http://localhost:8080/geonetwork/j_spring_security_check and exactly follow all 302 redirects with my HTTPClient including issued cookies (intermediate sessionid's), as said above.
I use java.net.HttpURLConnection, which has a default follow redirect property, which I had to set to false: con.setInstanceFollowRedirects(false);
This is due to the fact, that this does not seem to include cookies by default when doing redirects, so it does not work in this case and I had to do the redirects manually.