Thanks to the confirmation by Délawen that my approach is correct in general, I was fiddling about the security check a bit further.

GeoNetwork does two `302 redirect`s before returning the correct JSESSIONID with the response. Somehow, the Set-Cookie header from this response is not correctly transferred, if I use default follow redirect option of HttpURLConnection.

If I follow the redirects manually, I get a valid JSESSIONID after the last redirect.

Here my manual redirect output, in case it is relevant to somebody: 

(Interestingly, the intermediate JSESSIONID is not valid for private access and there is a referring parameter `failure=true`, but the final operation is sucessful anyway.)

    Sending 'POST' request to URL : http://localhost:8080/geonetwork/j_spring_security_check
    Response Code : 302
    Location: http://localhost:8080/geonetwork/login.jsp;jsessionid=8BE9A26FDB257A666AD016DA055FAA54?node=srv&failure=true
    Set-Cookie response: [JSESSIONID=8BE9A26FDB257A666AD016DA055FAA54; Path=/geonetwork/; HttpOnly]
    
    Sending 'POST' request to URL : http://localhost:8080/geonetwork/login.jsp;jsessionid=8BE9A26FDB257A666AD016DA055FAA54?node=srv&failure=true
    Response Code : 302
    Location: /geonetwork/srv/eng/catalog.signin;jsessionid=8BE9A26FDB257A666AD016DA055FAA54?node=srv&failure=true
    Set-Cookie response: null
    
    Sending 'POST' request to URL : http://localhost:8080/geonetwork/srv/eng/catalog.signin;jsessionid=8BE9A26FDB257A666AD016DA055FAA54?node=srv&failure=true
    Response Code : 200
    Set-Cookie response: [sessionExpiry=1489669687323; Path=/, serverTime=1489669687323; Path=/, JSESSIONID=F7296382C6CEEF3A41130B208597E5EC; Path=/geonetwork/; HttpOnly]

So what I now do is to request http://localhost:8080/geonetwork/srv/eng/catalog.signin directly and so far it works good.
I hope, it's not a temporary endpoint that changes frequently.