diff --git a/Dockerfile b/Dockerfile
index c965734..e447983 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -51,11 +51,15 @@ RUN rm -rf ${CATALINA_HOME}/webapps/ROOT \
   && cp -R guacamole-auth-jdbc-${GUAC_VER}/postgresql/schema ${GUACAMOLE_HOME}/ \
   && rm -rf guacamole-auth-jdbc-${GUAC_VER} guacamole-auth-jdbc-${GUAC_VER}.tar.gz
 
-# Add optional extensions that don't break the system when not configured
-  RUN curl -SLO "https://sourceforge.net/projects/guacamole/files/current/extensions/guacamole-auth-ldap-${GUAC_VER}.tar.gz" \
-    && tar -xzf guacamole-auth-ldap-${GUAC_VER}.tar.gz \
-    && cp guacamole-auth-ldap-${GUAC_VER}/guacamole-auth-ldap-${GUAC_VER}.jar ${GUACAMOLE_HOME}/extensions/ \
-    && rm -rf guacamole-auth-ldap-${GUAC_VER} guacamole-auth-ldap-${GUAC_VER}.tar.gz
+# Add optional extensions
+  RUN mkdir ${GUACAMOLE_HOME}/extensions-available \
+    && for i in auth-ldap auth-duo auth-header auth-noauth auth-cas; do \
+    echo "https://sourceforge.net/projects/guacamole/files/current/extensions/guacamole-${i}-${GUAC_VER}.tar.gz" \
+    && curl -SLO "https://sourceforge.net/projects/guacamole/files/current/extensions/guacamole-${i}-${GUAC_VER}.tar.gz" \
+    && tar -xzf guacamole-${i}-${GUAC_VER}.tar.gz \
+    && cp guacamole-${i}-${GUAC_VER}/guacamole-${i}-${GUAC_VER}.jar ${GUACAMOLE_HOME}/extensions-available/ \
+    && rm -rf guacamole-${i}-${GUAC_VER} guacamole-${i}-${GUAC_VER}.tar.gz \
+  ;done
 
 ENV PATH=/usr/lib/postgresql/${PG_MAJOR}/bin:$PATH
 ENV GUACAMOLE_HOME=/config/guacamole
diff --git a/README.md b/README.md
index fd6ccc1..d938b58 100644
--- a/README.md
+++ b/README.md
@@ -1,7 +1,7 @@
 # Docker Guacamole
 
 A Docker Container for [Apache Guacamole](https://guacamole.incubator.apache.org/), a clientless remote desktop gateway. It supports standard protocols like VNC, RDP, and SSH over HTML5.
-  
+
 [![IMAGE ALT TEXT](http://img.youtube.com/vi/esgaHNRxdhY/0.jpg)](http://www.youtube.com/watch?v=esgaHNRxdhY "Video Title")
 
 This container runs the guacamole web client, the guacd server and a postgres database.
@@ -21,6 +21,30 @@ The parameters are split into two halves, separated by a colon, the left hand si
 
 * `-p 8080:8080` - Binds the service to port 8080 on the Docker host, **required**
 * `-v /config` - The config and database location, **required**
+* `-e EXTENSIONS` - See below for details.
+
+## Enabling Extensions
+
+Extensions can be enabled using the `-e EXTENSIONS` variable. Multiple extensions can be enabled using a comma separated list without spaces.
+
+For example:
+
+```shell
+docker run \
+  -p 8080:8080 \
+  -v </path/to/config>:/config \
+  -e "EXTENSIONS=auth-ldap,auth-duo"
+  oznu/guacamole
+```
+
+Currently the available extensions are:
+
+* auth-ldap - [LDAP Authentication](https://guacamole.incubator.apache.org/doc/0.9.13-incubating/gug/ldap-auth.html)
+* auth-duo - [Duo two-factor authentication](https://guacamole.incubator.apache.org/doc/0.9.13-incubating/gug/duo-auth.html)
+* auth-header - [HTTP header authentication](https://guacamole.incubator.apache.org/doc/0.9.13-incubating/gug/header-auth.html)
+* auth-cas - [CAS Authentication](https://guacamole.incubator.apache.org/doc/0.9.13-incubating/gug/cas-auth.html)
+
+You should only enable the extensions you require, if an extensions is not configured correctly in the `guacamole.properties` file it may prevent the system from loading. See the [official documentation](https://guacamole.incubator.apache.org/doc/0.9.13-incubating/gug/) for more details.
 
 ## Default User
 
diff --git a/root/etc/cont-init.d/50-extensions b/root/etc/cont-init.d/50-extensions
new file mode 100644
index 0000000..18d767e
--- /dev/null
+++ b/root/etc/cont-init.d/50-extensions
@@ -0,0 +1,11 @@
+#!/usr/bin/with-contenv sh
+
+# clean up extensions
+for i in auth-ldap auth-duo auth-header auth-noauth auth-cas; do
+  rm -rf ${GUACAMOLE_HOME}/extensions/guacamole-${i}-${GUAC_VER}.jar
+done
+
+# enable extensions
+for i in $(echo "$EXTENSIONS" | tr "," " "); do
+  cp ${GUACAMOLE_HOME}/extensions-available/guacamole-${i}-${GUAC_VER}.jar ${GUACAMOLE_HOME}/extensions
+done