diff -Nru sudo-1.8.21p2/debian/changelog sudo-1.8.21p2/debian/changelog
--- sudo-1.8.21p2/debian/changelog	2017-11-13 16:53:45.000000000 +0000
+++ sudo-1.8.21p2/debian/changelog	2018-01-18 00:08:16.000000000 +0000
@@ -1,3 +1,36 @@
+sudo (1.8.21p2-3ubuntu1) bionic; urgency=medium
+
+  * Merge from Debian unstable.
+    Remaining changes:
+    - debian/rules, debian/sudo.service, debian/sudo.sudo.init: stop
+      shipping init script and service file, as they are no longer
+      necessary.
+    - debian/rules:
+      + compile with --without-lecture --with-tty-tickets --enable-admin-flag
+      + install man/man8/sudo_root.8 in both flavours
+      + install apport hooks
+    - debian/source_sudo.py, debian/sudo-ldap.dirs, debian/sudo.dirs:
+      + add usr/share/apport/package-hooks
+    - debian/sudo.pam:
+      + Use pam_env to read /etc/environment and /etc/default/locale
+        environment files. Reading ~/.pam_environment is not permitted due to
+        security reasons.
+    - debian/sudoers:
+      + also grant admin group sudo access
+      + include /snap/bin in the secure_path
+    - debian/control, debian/rules:
+      + use dh-autoreconf
+    - Remaining patches:
+      + keep_home_by_default.patch: Keep HOME in the default environment
+
+ -- Balint Reczey <rbalint@ubuntu.com>  Thu, 18 Jan 2018 01:08:16 +0100
+
+sudo (1.8.21p2-3) unstable; urgency=medium
+
+  * include sssd support in the sudo-ldap build too, closes: #884741
+
+ -- Bdale Garbee <bdale@gag.com>  Mon, 18 Dec 2017 21:55:18 -0700
+
 sudo (1.8.21p2-2ubuntu1) bionic; urgency=medium
 
   * Merge from Debian unstable. (LP: #1731981)
diff -Nru sudo-1.8.21p2/debian/rules sudo-1.8.21p2/debian/rules
--- sudo-1.8.21p2/debian/rules	2017-11-13 16:53:45.000000000 +0000
+++ sudo-1.8.21p2/debian/rules	2018-01-18 00:08:16.000000000 +0000
@@ -75,6 +75,7 @@
 		--with-rundir=/run/sudo \
 		--with-ldap-conf-file=/etc/sudo-ldap.conf \
 		--libexecdir=/usr/lib/sudo \
+		--with-sssd --with-sssd-lib=/usr/lib/$(DEB_HOST_MULTIARCH) \
 		$(configure_args)
 
 	touch configure-stamp