As an alternative to the Crystal Reports ActiveX viewer on IIS, we ended up using a solution which was a mixture of this EE post http://www.experts-exchange.com/Database/Reporting_/Crystal_Reports/Q_22689905.html
and the post by Hilfy here http://www.crystalreportsbook.com/forum/forum_posts.asp?TID=589
Basically, we store the cr datasource username, password, and server in web.config - and on page load the report name is in the query string of the URL. Works PERFECTLY and we are very happy with it.
However, when we attempt to refresh the page it prompts for the database password again.
I've been scouring for several hours to figure out why this happens... any idea? I tried moving to Page_Init instead of Page_Load, same issue. I was wondering if there was something specific I was missing.