I just did a test between a controller running v4.2.207.0 and a Cisco ACS server v4.2(0) for a guest user. In that combination, the maximum number of characters that can be used is 32 characters. 24 characters is the maximum for internal users on the controller, such as the administrator account created when first configuring the box. I don't know if other combinations (version levels, using Windows AD/IAS/etc.) would yield better results.