Thanks to the confirmation by Délawen that my approach is correct in general, I was fiddling about the security check a bit further.
GeoNetwork does two 302 redirects before returning the correct JSESSIONID with the response. Somehow, the Set-Cookie header from this response is not correctly transferred, if I use default follow redirect option of HttpURLConnection.
If I follow the redirects manually, I get a valid JSESSIONID after the last redirect.
Here my manual redirect output, in case it is relevant to somebody:
(Interestingly, the intermediate JSESSIONID is not valid for private access and there is a referring parameter failure=true, but the final operation is sucessful anyway.)
Sending 'POST' request to URL : http://localhost:8080/geonetwork/j_spring_security_check
Response Code : 302
Location: http://localhost:8080/geonetwork/login.jsp;jsessionid=8BE9A26FDB257A666AD016DA055FAA54?node=srv&failure=true
Set-Cookie response: [JSESSIONID=8BE9A26FDB257A666AD016DA055FAA54; Path=/geonetwork/; HttpOnly]
Sending 'POST' request to URL : http://localhost:8080/geonetwork/login.jsp;jsessionid=8BE9A26FDB257A666AD016DA055FAA54?node=srv&failure=true
Response Code : 302
Location: /geonetwork/srv/eng/catalog.signin;jsessionid=8BE9A26FDB257A666AD016DA055FAA54?node=srv&failure=true
Set-Cookie response: null
Sending 'POST' request to URL : http://localhost:8080/geonetwork/srv/eng/catalog.signin;jsessionid=8BE9A26FDB257A666AD016DA055FAA54?node=srv&failure=true
Response Code : 200
Set-Cookie response: [sessionExpiry=1489669687323; Path=/, serverTime=1489669687323; Path=/, JSESSIONID=F7296382C6CEEF3A41130B208597E5EC; Path=/geonetwork/; HttpOnly]
So what I now do is to request http://localhost:8080/geonetwork/srv/eng/catalog.signin directly and so far it works good. I hope, it's not a temporary endpoint that changes frequently.